---
- name: Update apt package index
  ansible.builtin.apt:
    update_cache: true
    cache_valid_time: 3600

- name: Install Fail2Ban
  ansible.builtin.apt:
    name: fail2ban
    state: present

- name: Ensure Fail2Ban service is enabled and running
  ansible.builtin.service:
    name: fail2ban
    enabled: true
    state: started

- name: Configure Fail2Ban for SSH
  ansible.builtin.template:
    src: jail.local.j2
    dest: /etc/fail2ban/jail.local
    mode: '0644'
  notify: Restart fail2ban