From 24502f543f009ce24d6612835c84b6b2eb2698ad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cl=C3=A9ment=20D=C3=A9siles?=
 <1536672+cdesiles@users.noreply.github.com>
Date: Sat, 5 Sep 2026 16:57:45 +0200
Subject: [PATCH] fix(fail2ban): pass blocktype via banaction to override the
 ufw action default

jail-level blocktype is ignored (action [Init] wins); it must be
passed as banaction = ufw[blocktype=deny].
---
 roles/fail2ban/templates/jail.local.j2 | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/roles/fail2ban/templates/jail.local.j2 b/roles/fail2ban/templates/jail.local.j2
index 6ceeec6..c3deea4 100644
--- a/roles/fail2ban/templates/jail.local.j2
+++ b/roles/fail2ban/templates/jail.local.j2
@@ -1,8 +1,7 @@
 [DEFAULT]
 bantime    = 1d
-banaction  = {{fail2ban_firewall}}
+banaction  = {{fail2ban_firewall}}[blocktype={{fail2ban_blocktype}}]
 allowipv6  = true
 ignoreip   = 127.0.0.1/8
 backend    = {{fail2ban_backend}}
-blocktype  = {{fail2ban_blocktype}}
 ignoreself = true