From 6355a9aae56df4098e8a17baeaf562c1181262fe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cl=C3=A9ment=20D=C3=A9siles?=
 <1536672+cdesiles@users.noreply.github.com>
Date: Sat, 5 Sep 2026 16:45:12 +0200
Subject: [PATCH] fix(fail2ban): ban via ufw deny (DROP) instead of reject

REJECT needs the nft_reject kernel extension, which is unavailable on
this Arch kernel (iptables-nft reports 'Extension REJECT revision 0
not supported'), so every ban silently failed. DROP works everywhere
and is quieter toward attackers.
---
 roles/fail2ban/README.md               | 2 +-
 roles/fail2ban/defaults/main.yml       | 1 +
 roles/fail2ban/templates/jail.local.j2 | 1 +
 3 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/roles/fail2ban/README.md b/roles/fail2ban/README.md
index 911da51..f5f6004 100644
--- a/roles/fail2ban/README.md
+++ b/roles/fail2ban/README.md
@@ -11,7 +11,7 @@ Bans brute-force sources via UFW. Reads logs from the systemd journal (`backend
 
 - Logs to the journal (`logtarget = STDOUT` in `fail2ban.local`) — see `journalctl -u fail2ban`.
 - The systemd unit is hardened (`ProtectSystem=full`); the drop-in lives at `/etc/systemd/system/fail2ban.service.d/override.conf` and is fully managed by the role.
-- Firewall/banaction is UFW on every host; jails ban via `ufw prepend reject`.
+- Firewall/banaction is UFW on every host; jails ban via `ufw prepend deny` (DROP — no kernel `REJECT` extension needed, and it doesn't reveal the host to attackers).
 
 ## Variables
 
diff --git a/roles/fail2ban/defaults/main.yml b/roles/fail2ban/defaults/main.yml
index 0f75db3..4312f8c 100644
--- a/roles/fail2ban/defaults/main.yml
+++ b/roles/fail2ban/defaults/main.yml
@@ -1,3 +1,4 @@
 ---
 fail2ban_firewall: ufw
 fail2ban_backend: systemd
+fail2ban_blocktype: deny
diff --git a/roles/fail2ban/templates/jail.local.j2 b/roles/fail2ban/templates/jail.local.j2
index 01361ba..6ceeec6 100644
--- a/roles/fail2ban/templates/jail.local.j2
+++ b/roles/fail2ban/templates/jail.local.j2
@@ -4,4 +4,5 @@ banaction  = {{fail2ban_firewall}}
 allowipv6  = true
 ignoreip   = 127.0.0.1/8
 backend    = {{fail2ban_backend}}
+blocktype  = {{fail2ban_blocktype}}
 ignoreself = true