---
- name: Fail2ban Installation and Configuration
  block:
    - name: Install fail2ban
      ansible.builtin.apt:
        name: fail2ban
        state: present
        update_cache: true

    - name: Deploy fail2ban jail configuration
      ansible.builtin.template:
        src: jail.local.j2
        dest: /etc/fail2ban/jail.local
        owner: root
        group: root
        mode: "0644"
        backup: true
      notify: Restart fail2ban

    - name: Deploy SSH DDoS filter
      ansible.builtin.copy:
        src: sshd-ddos.conf
        dest: /etc/fail2ban/filter.d/sshd-ddos.conf
        owner: root
        group: root
        mode: "0644"
      notify: Restart fail2ban

    - name: Enable and start fail2ban service
      ansible.builtin.systemd:
        name: fail2ban
        enabled: true
        state: started
        daemon_reload: true
