add fail2ban role

roles/server_install_fail2ban/defaults/main.yml

@@ -0,0 +1,5 @@
+---
+fail2ban_ssh_enabled: true
+fail2ban_ssh_maxretry: 5
+fail2ban_ssh_bantime: 1h
+fail2ban_ssh_findtime: 1h

roles/server_install_fail2ban/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: Restart fail2ban
+  ansible.builtin.service:
+    name: fail2ban
+    state: restarted

roles/server_install_fail2ban/tasks/main.yml

@@ -0,0 +1,23 @@
+---
+- name: Update apt package index
+  ansible.builtin.apt:
+    update_cache: true
+    cache_valid_time: 3600
+
+- name: Install Fail2Ban
+  ansible.builtin.apt:
+    name: fail2ban
+    state: present
+
+- name: Ensure Fail2Ban service is enabled and running
+  ansible.builtin.service:
+    name: fail2ban
+    enabled: true
+    state: started
+
+- name: Configure Fail2Ban for SSH
+  ansible.builtin.template:
+    src: jail.local.j2
+    dest: /etc/fail2ban/jail.local
+    mode: '0644'
+  notify: Restart fail2ban

roles/server_install_fail2ban/templates/jail.local.j2

@@ -0,0 +1,15 @@
+[DEFAULT]
+# Ignore local IP addresses
+ignoreip = 127.0.0.1/8 ::1
+
+# Ban settings
+bantime = {{ fail2ban_ssh_bantime }}
+findtime = {{ fail2ban_ssh_findtime }}
+maxretry = {{ fail2ban_ssh_maxretry }}
+
+[sshd]
+enabled = {{ fail2ban_ssh_enabled | lower }}
+port = ssh
+filter = sshd
+logpath = %(sshd_log)s
+maxretry = {{ fail2ban_ssh_maxretry }}