Add fail2ban role and clean up yaml lint noise

roles/ensure_fail2ban/handlers/main.yml

@@ -0,0 +1,14 @@
+---
+# handlers file for ensure_fail2ban
+- name: ensure_fail2ban.package_facts
+  ansible.builtin.package_facts:
+- name: ensure_fail2ban.service_facts
+  ansible.builtin.service_facts:
+- name: ensure_fail2ban.service_reload
+  ansible.builtin.service:
+    name: fail2ban
+    state: reloaded
+- name: ensure_fail2ban.service_restart
+  ansible.builtin.service:
+    name: fail2ban
+    state: restarted

roles/ensure_fail2ban/meta/main.yml

@@ -0,0 +1,3 @@
+---
+dependencies:
+  - role: ensure_os_patch

roles/ensure_fail2ban/tasks/main.yml

@@ -0,0 +1,130 @@
+---
+# tasks file for ensure_fail2ban
+- name: include variables
+  when: ["ansible_facts[\"system\"] == 'Linux'"]
+  ansible.builtin.include_vars:
+    file: '{{ lookup("first_found", findme) }}'
+    name: ensure_fail2ban
+  vars:
+    findme:
+      files:
+        - '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"]
+          }}-{{ ansible_facts["architecture"] }}.yml'
+        - '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"]
+          }}-default.yml'
+        - '{{ ansible_facts["distribution"] }}-default.yml'
+        - '{{ ansible_facts["os_family"] }}-{{ ansible_facts["distribution_major_version"]
+          }}-{{ ansible_facts["architecture"] }}.yml'
+        - '{{ ansible_facts["os_family"] }}-{{ ansible_facts["distribution_major_version"]
+          }}-default.yml'
+        - '{{ ansible_facts["os_family"] }}-default.yml'
+        - default.yml
+      paths: [../vars/]
+      errors: ignore
+- name: package discovery
+  when:
+    - ansible_facts["system"] == 'Linux'
+    - ansible_facts["packages"] is not defined
+  ansible.builtin.package_facts:
+- name: service discovery
+  when:
+    - ansible_facts["system"] == 'Linux'
+    - ansible_facts["services"] is not defined
+  ansible.builtin.service_facts:
+- name: ensure packages
+  when:
+    - ansible_facts["system"] == 'Linux'
+    - ensure_fail2ban is defined
+    - ensure_fail2ban.package_list is defined
+    - ensure_fail2ban.package_list is iterable
+  ansible.builtin.package:
+    name: '{{ item.name }}'
+    state: '{{ item.state }}'
+  loop: '{{ ensure_fail2ban.package_list }}'
+  loop_control:
+    label: '{{ item.name }} will be {{ item.state }}'
+  notify: [ensure_fail2ban.package_facts, ensure_fail2ban.service_facts]
+- name: ensure configurations
+  when:
+    - ansible_facts["system"] == 'Linux'
+    - ensure_fail2ban is defined
+    - ensure_fail2ban.template_list is defined
+    - ensure_fail2ban.template_list is iterable
+  ansible.builtin.template:
+    backup: 'no'
+    dest: '{{ item.dest }}'
+    group: '{{ item.group | default(omit) }}'
+    mode: '{{ item.mode | default(omit) }}'
+    owner: '{{ item.owner | default(omit) }}'
+    selevel: '{{ item.selevel | default(omit) }}'
+    serole: '{{ item.serole | default(omit) }}'
+    setype: '{{ item.setype | default(omit) }}'
+    seuser: '{{ item.seuser | default(omit) }}'
+    src: '{{ item.src }}'
+  loop: '{{ ensure_fail2ban.template_list }}'
+  loop_control:
+    label: '{{ item.dest }} will be ensured'
+  notify:
+    - ensure_fail2ban.package_facts
+    - ensure_fail2ban.service_facts
+    - ensure_fail2ban.service_reload
+    - ensure_fail2ban.service_restart
+- name: ensure services
+  when:
+    - ansible_facts["system"] == 'Linux'
+    - ensure_fail2ban is defined
+    - ensure_fail2ban.service_list is defined
+    - ensure_fail2ban.service_list is iterable
+  ansible.builtin.service:
+    enabled: '{{ item.enabled }}'
+    name: '{{ item.name }}'
+    state: '{{ item.state }}'
+  loop: '{{ ensure_fail2ban.service_list }}'
+  loop_control:
+    label: '{{ item.name }} will be {{ item.state }}'
+  notify: [ensure_fail2ban.package_facts, ensure_fail2ban.service_facts]
+- name: Ensure SELinux is configured
+  when:
+    - ansible_facts["system"] == 'Linux'
+    - ensure_fail2ban is defined
+    - ensure_fail2ban.selinux_policy is defined
+    - ensure_fail2ban.selinux_state is defined
+  ansible.posix.selinux:
+    policy: '{{ ensure_fail2ban.selinux_policy }}'
+    state: '{{ ensure_fail2ban.selinux_state }}'
+  register: ensure_fail2ban_results
+  notify:
+    - ensure_fail2ban.package_facts
+    - ensure_fail2ban.service_facts
+    - ensure_fail2ban.service_reload
+    - ensure_fail2ban.service_restart
+- name: Reboot if required
+  when:
+    - ansible_facts["system"] == 'Linux'
+    - ensure_fail2ban is defined
+    - ensure_fail2ban.selinux_policy is defined
+    - ensure_fail2ban.selinux_state is defined
+    - ensure_fail2ban_results is defined
+    - ensure_fail2ban_results.reboot_required is defined
+    - ensure_fail2ban_results.reboot_required
+  ansible.builtin.reboot:
+- name: ensure seboolean
+  when:
+    - ansible_facts["system"] == 'Linux'
+    - ensure_fail2ban is defined
+    - ensure_fail2ban.seboolean_list is defined
+    - ensure_fail2ban.seboolean_list is iterable
+  ansible.posix.seboolean:
+    name: '{{ item.name }}'
+    persistent: '{{ item.persistent }}'
+    state: '{{ item.state }}'
+  loop: '{{ ensure_fail2ban.seboolean_list }}'
+  loop_control:
+    label: '{{ item.name }} will be {{ item.state }}'
+  notify:
+    - ensure_fail2ban.package_facts
+    - ensure_fail2ban.service_facts
+    - ensure_fail2ban.service_reload
+    - ensure_fail2ban.service_restart
+- name: flush handlers
+  ansible.builtin.meta: flush_handlers

roles/ensure_fail2ban/templates/Debian/11/etc/fail2ban/jail.d/99-custom_jails.conf.j2

@@ -0,0 +1,37 @@
+# Default block/ban configuration
+[DEFAULT]
+bantime = 1h
+findtime = 10m
+maxretry = 5
+banaction = iptables-multiport
+backend = systemd
+
+# SSH is enabled on all servers
+[sshd]
+enabled = true
+
+# Apache
+[apache-auth]
+enabled = {{ 'true' if ('httpd' in ansible_facts.packages or 'apache2' in ansible_facts.packages) else 'false' }}
+
+[apache-badbots]
+enabled = {{ 'true' if ('httpd' in ansible_facts.packages or 'apache2' in ansible_facts.packages) else 'false' }}
+
+[apache-noscript]
+enabled = {{ 'true' if ('httpd' in ansible_facts.packages or 'apache2' in ansible_facts.packages) else 'false' }}
+
+[apache-overflows]
+enabled = {{ 'true' if ('httpd' in ansible_facts.packages or 'apache2' in ansible_facts.packages) else 'false' }}
+
+# Postfix
+[postfix]
+enabled = {{ 'true' if 'postfix' in ansible_facts.packages else 'false' }}
+
+# Dovecot
+[dovecot]
+enabled = {{ 'true' if 'dovecot' in ansible_facts.packages or 'dovecot-core' in ansible_facts.packages else 'false' }}
+
+# MariaDB / MySQL
+[mysqld-auth]
+enabled = {{ 'true' if ('mariadb-server' in ansible_facts.packages or 'mariadb' in ansible_facts.packages or 'mysql-server' in ansible_facts.packages) else 'false' }}
+

roles/ensure_fail2ban/templates/Debian/12/etc/fail2ban/jail.d/99-custom_jails.conf.j2

@@ -0,0 +1,37 @@
+# Default block/ban configuration
+[DEFAULT]
+bantime = 1h
+findtime = 10m
+maxretry = 5
+banaction = iptables-multiport
+backend = systemd
+
+# SSH is enabled on all servers
+[sshd]
+enabled = true
+
+# Apache
+[apache-auth]
+enabled = {{ 'true' if ('httpd' in ansible_facts.packages or 'apache2' in ansible_facts.packages) else 'false' }}
+
+[apache-badbots]
+enabled = {{ 'true' if ('httpd' in ansible_facts.packages or 'apache2' in ansible_facts.packages) else 'false' }}
+
+[apache-noscript]
+enabled = {{ 'true' if ('httpd' in ansible_facts.packages or 'apache2' in ansible_facts.packages) else 'false' }}
+
+[apache-overflows]
+enabled = {{ 'true' if ('httpd' in ansible_facts.packages or 'apache2' in ansible_facts.packages) else 'false' }}
+
+# Postfix
+[postfix]
+enabled = {{ 'true' if 'postfix' in ansible_facts.packages else 'false' }}
+
+# Dovecot
+[dovecot]
+enabled = {{ 'true' if 'dovecot' in ansible_facts.packages or 'dovecot-core' in ansible_facts.packages else 'false' }}
+
+# MariaDB / MySQL
+[mysqld-auth]
+enabled = {{ 'true' if ('mariadb-server' in ansible_facts.packages or 'mariadb' in ansible_facts.packages or 'mysql-server' in ansible_facts.packages) else 'false' }}
+

roles/ensure_fail2ban/templates/Debian/13/etc/fail2ban/jail.d/99-custom_jails.conf.j2

@@ -0,0 +1,37 @@
+# Default block/ban configuration
+[DEFAULT]
+bantime = 1h
+findtime = 10m
+maxretry = 5
+banaction = iptables-multiport
+backend = systemd
+
+# SSH is enabled on all servers
+[sshd]
+enabled = true
+
+# Apache
+[apache-auth]
+enabled = {{ 'true' if ('httpd' in ansible_facts.packages or 'apache2' in ansible_facts.packages) else 'false' }}
+
+[apache-badbots]
+enabled = {{ 'true' if ('httpd' in ansible_facts.packages or 'apache2' in ansible_facts.packages) else 'false' }}
+
+[apache-noscript]
+enabled = {{ 'true' if ('httpd' in ansible_facts.packages or 'apache2' in ansible_facts.packages) else 'false' }}
+
+[apache-overflows]
+enabled = {{ 'true' if ('httpd' in ansible_facts.packages or 'apache2' in ansible_facts.packages) else 'false' }}
+
+# Postfix
+[postfix]
+enabled = {{ 'true' if 'postfix' in ansible_facts.packages else 'false' }}
+
+# Dovecot
+[dovecot]
+enabled = {{ 'true' if 'dovecot' in ansible_facts.packages or 'dovecot-core' in ansible_facts.packages else 'false' }}
+
+# MariaDB / MySQL
+[mysqld-auth]
+enabled = {{ 'true' if ('mariadb-server' in ansible_facts.packages or 'mariadb' in ansible_facts.packages or 'mysql-server' in ansible_facts.packages) else 'false' }}
+

roles/ensure_fail2ban/templates/Fedora/43/etc/fail2ban/jail.d/99-custom_jails.conf.j2

@@ -0,0 +1,37 @@
+# Default block/ban configuration
+[DEFAULT]
+bantime = 1h
+findtime = 10m
+maxretry = 5
+banaction = firewallcmd-rich-rules
+backend = systemd
+
+# SSH is enabled on all servers
+[sshd]
+enabled = true
+
+# Apache
+[apache-auth]
+enabled = {{ 'true' if ('httpd' in ansible_facts.packages or 'apache2' in ansible_facts.packages) else 'false' }}
+
+[apache-badbots]
+enabled = {{ 'true' if ('httpd' in ansible_facts.packages or 'apache2' in ansible_facts.packages) else 'false' }}
+
+[apache-noscript]
+enabled = {{ 'true' if ('httpd' in ansible_facts.packages or 'apache2' in ansible_facts.packages) else 'false' }}
+
+[apache-overflows]
+enabled = {{ 'true' if ('httpd' in ansible_facts.packages or 'apache2' in ansible_facts.packages) else 'false' }}
+
+# Postfix
+[postfix]
+enabled = {{ 'true' if 'postfix' in ansible_facts.packages else 'false' }}
+
+# Dovecot
+[dovecot]
+enabled = {{ 'true' if 'dovecot' in ansible_facts.packages or 'dovecot-core' in ansible_facts.packages else 'false' }}
+
+# MariaDB / MySQL
+[mysqld-auth]
+enabled = {{ 'true' if ('mariadb-server' in ansible_facts.packages or 'mariadb' in ansible_facts.packages or 'mysql-server' in ansible_facts.packages) else 'false' }}
+

roles/ensure_fail2ban/templates/Fedora/44/etc/fail2ban/jail.d/99-custom_jails.conf.j2

@@ -0,0 +1,37 @@
+# Default block/ban configuration
+[DEFAULT]
+bantime = 1h
+findtime = 10m
+maxretry = 5
+banaction = firewallcmd-rich-rules
+backend = systemd
+
+# SSH is enabled on all servers
+[sshd]
+enabled = true
+
+# Apache
+[apache-auth]
+enabled = {{ 'true' if ('httpd' in ansible_facts.packages or 'apache2' in ansible_facts.packages) else 'false' }}
+
+[apache-badbots]
+enabled = {{ 'true' if ('httpd' in ansible_facts.packages or 'apache2' in ansible_facts.packages) else 'false' }}
+
+[apache-noscript]
+enabled = {{ 'true' if ('httpd' in ansible_facts.packages or 'apache2' in ansible_facts.packages) else 'false' }}
+
+[apache-overflows]
+enabled = {{ 'true' if ('httpd' in ansible_facts.packages or 'apache2' in ansible_facts.packages) else 'false' }}
+
+# Postfix
+[postfix]
+enabled = {{ 'true' if 'postfix' in ansible_facts.packages else 'false' }}
+
+# Dovecot
+[dovecot]
+enabled = {{ 'true' if 'dovecot' in ansible_facts.packages or 'dovecot-core' in ansible_facts.packages else 'false' }}
+
+# MariaDB / MySQL
+[mysqld-auth]
+enabled = {{ 'true' if ('mariadb-server' in ansible_facts.packages or 'mariadb' in ansible_facts.packages or 'mysql-server' in ansible_facts.packages) else 'false' }}
+

roles/ensure_fail2ban/templates/Ubuntu/22/etc/fail2ban/jail.d/99-custom_jails.conf.j2

@@ -0,0 +1,37 @@
+# Default block/ban configuration
+[DEFAULT]
+bantime = 1h
+findtime = 10m
+maxretry = 5
+banaction = iptables-multiport
+backend = systemd
+
+# SSH is enabled on all servers
+[sshd]
+enabled = true
+
+# Apache
+[apache-auth]
+enabled = {{ 'true' if ('httpd' in ansible_facts.packages or 'apache2' in ansible_facts.packages) else 'false' }}
+
+[apache-badbots]
+enabled = {{ 'true' if ('httpd' in ansible_facts.packages or 'apache2' in ansible_facts.packages) else 'false' }}
+
+[apache-noscript]
+enabled = {{ 'true' if ('httpd' in ansible_facts.packages or 'apache2' in ansible_facts.packages) else 'false' }}
+
+[apache-overflows]
+enabled = {{ 'true' if ('httpd' in ansible_facts.packages or 'apache2' in ansible_facts.packages) else 'false' }}
+
+# Postfix
+[postfix]
+enabled = {{ 'true' if 'postfix' in ansible_facts.packages else 'false' }}
+
+# Dovecot
+[dovecot]
+enabled = {{ 'true' if 'dovecot' in ansible_facts.packages or 'dovecot-core' in ansible_facts.packages else 'false' }}
+
+# MariaDB / MySQL
+[mysqld-auth]
+enabled = {{ 'true' if ('mariadb-server' in ansible_facts.packages or 'mariadb' in ansible_facts.packages or 'mysql-server' in ansible_facts.packages) else 'false' }}
+

roles/ensure_fail2ban/templates/Ubuntu/24/etc/fail2ban/jail.d/99-custom_jails.conf.j2

@@ -0,0 +1,37 @@
+# Default block/ban configuration
+[DEFAULT]
+bantime = 1h
+findtime = 10m
+maxretry = 5
+banaction = iptables-multiport
+backend = systemd
+
+# SSH is enabled on all servers
+[sshd]
+enabled = true
+
+# Apache
+[apache-auth]
+enabled = {{ 'true' if ('httpd' in ansible_facts.packages or 'apache2' in ansible_facts.packages) else 'false' }}
+
+[apache-badbots]
+enabled = {{ 'true' if ('httpd' in ansible_facts.packages or 'apache2' in ansible_facts.packages) else 'false' }}
+
+[apache-noscript]
+enabled = {{ 'true' if ('httpd' in ansible_facts.packages or 'apache2' in ansible_facts.packages) else 'false' }}
+
+[apache-overflows]
+enabled = {{ 'true' if ('httpd' in ansible_facts.packages or 'apache2' in ansible_facts.packages) else 'false' }}
+
+# Postfix
+[postfix]
+enabled = {{ 'true' if 'postfix' in ansible_facts.packages else 'false' }}
+
+# Dovecot
+[dovecot]
+enabled = {{ 'true' if 'dovecot' in ansible_facts.packages or 'dovecot-core' in ansible_facts.packages else 'false' }}
+
+# MariaDB / MySQL
+[mysqld-auth]
+enabled = {{ 'true' if ('mariadb-server' in ansible_facts.packages or 'mariadb' in ansible_facts.packages or 'mysql-server' in ansible_facts.packages) else 'false' }}
+

roles/ensure_fail2ban/templates/Ubuntu/26/etc/fail2ban/jail.d/99-custom_jails.conf.j2

@@ -0,0 +1,37 @@
+# Default block/ban configuration
+[DEFAULT]
+bantime = 1h
+findtime = 10m
+maxretry = 5
+banaction = iptables-multiport
+backend = systemd
+
+# SSH is enabled on all servers
+[sshd]
+enabled = true
+
+# Apache
+[apache-auth]
+enabled = {{ 'true' if ('httpd' in ansible_facts.packages or 'apache2' in ansible_facts.packages) else 'false' }}
+
+[apache-badbots]
+enabled = {{ 'true' if ('httpd' in ansible_facts.packages or 'apache2' in ansible_facts.packages) else 'false' }}
+
+[apache-noscript]
+enabled = {{ 'true' if ('httpd' in ansible_facts.packages or 'apache2' in ansible_facts.packages) else 'false' }}
+
+[apache-overflows]
+enabled = {{ 'true' if ('httpd' in ansible_facts.packages or 'apache2' in ansible_facts.packages) else 'false' }}
+
+# Postfix
+[postfix]
+enabled = {{ 'true' if 'postfix' in ansible_facts.packages else 'false' }}
+
+# Dovecot
+[dovecot]
+enabled = {{ 'true' if 'dovecot' in ansible_facts.packages or 'dovecot-core' in ansible_facts.packages else 'false' }}
+
+# MariaDB / MySQL
+[mysqld-auth]
+enabled = {{ 'true' if ('mariadb-server' in ansible_facts.packages or 'mariadb' in ansible_facts.packages or 'mysql-server' in ansible_facts.packages) else 'false' }}
+

roles/ensure_fail2ban/vars/Debian-11-default.yml

@@ -0,0 +1,16 @@
+---
+# vars file for ensure_fail2ban
+package_list:
+  - name: fail2ban
+    state: present
+service_list:
+  - name: fail2ban
+    state: started
+    enabled: true
+template_list:
+  - dest: /etc/fail2ban/jail.d/99-custom_jails.conf
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/fail2ban/jail.d/99-custom_jails.conf.j2'
+    owner: root
+    group: root
+    mode: '0644'

roles/ensure_fail2ban/vars/Debian-12-default.yml

@@ -0,0 +1,16 @@
+---
+# vars file for ensure_fail2ban
+package_list:
+  - name: fail2ban
+    state: present
+service_list:
+  - name: fail2ban
+    state: started
+    enabled: true
+template_list:
+  - dest: /etc/fail2ban/jail.d/99-custom_jails.conf
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/fail2ban/jail.d/99-custom_jails.conf.j2'
+    owner: root
+    group: root
+    mode: '0644'

roles/ensure_fail2ban/vars/Debian-13-default.yml

@@ -0,0 +1,16 @@
+---
+# vars file for ensure_fail2ban
+package_list:
+  - name: fail2ban
+    state: present
+service_list:
+  - name: fail2ban
+    state: started
+    enabled: true
+template_list:
+  - dest: /etc/fail2ban/jail.d/99-custom_jails.conf
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/fail2ban/jail.d/99-custom_jails.conf.j2'
+    owner: root
+    group: root
+    mode: '0644'

roles/ensure_fail2ban/vars/Fedora-43-default.yml

@@ -0,0 +1,16 @@
+---
+# vars file for ensure_fail2ban
+package_list:
+  - name: fail2ban-all
+    state: present
+service_list:
+  - name: fail2ban
+    state: started
+    enabled: true
+template_list:
+  - dest: /etc/fail2ban/jail.d/99-custom_jails.conf
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/fail2ban/jail.d/99-custom_jails.conf.j2'
+    owner: root
+    group: root
+    mode: '0644'

roles/ensure_fail2ban/vars/Fedora-44-default.yml

@@ -0,0 +1,16 @@
+---
+# vars file for ensure_fail2ban
+package_list:
+  - name: fail2ban-all
+    state: present
+service_list:
+  - name: fail2ban
+    state: started
+    enabled: true
+template_list:
+  - dest: /etc/fail2ban/jail.d/99-custom_jails.conf
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/fail2ban/jail.d/99-custom_jails.conf.j2'
+    owner: root
+    group: root
+    mode: '0644'

roles/ensure_fail2ban/vars/Ubuntu-22-default.yml

@@ -0,0 +1,16 @@
+---
+# vars file for ensure_fail2ban
+package_list:
+  - name: fail2ban
+    state: present
+service_list:
+  - name: fail2ban
+    state: started
+    enabled: true
+template_list:
+  - dest: /etc/fail2ban/jail.d/99-custom_jails.conf
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/fail2ban/jail.d/99-custom_jails.conf.j2'
+    owner: root
+    group: root
+    mode: '0644'

roles/ensure_fail2ban/vars/Ubuntu-24-default.yml

@@ -0,0 +1,16 @@
+---
+# vars file for ensure_fail2ban
+package_list:
+  - name: fail2ban
+    state: present
+service_list:
+  - name: fail2ban
+    state: started
+    enabled: true
+template_list:
+  - dest: /etc/fail2ban/jail.d/99-custom_jails.conf
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/fail2ban/jail.d/99-custom_jails.conf.j2'
+    owner: root
+    group: root
+    mode: '0644'

roles/ensure_fail2ban/vars/Ubuntu-26-default.yml

@@ -0,0 +1,16 @@
+---
+# vars file for ensure_fail2ban
+package_list:
+  - name: fail2ban
+    state: present
+service_list:
+  - name: fail2ban
+    state: started
+    enabled: true
+template_list:
+  - dest: /etc/fail2ban/jail.d/99-custom_jails.conf
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"]
+      }}/etc/fail2ban/jail.d/99-custom_jails.conf.j2'
+    owner: root
+    group: root
+    mode: '0644'

roles/ensure_fail2ban/vars/default.yml

@@ -0,0 +1,2 @@
+---
+...

roles/ensure_fail2ban/vars/main.yml

@@ -0,0 +1,2 @@
+---
+...