fix(fail2ban): ban via ufw deny (DROP) instead of reject

REJECT needs the nft_reject kernel extension, which is unavailable on
this Arch kernel (iptables-nft reports 'Extension REJECT revision 0
not supported'), so every ban silently failed. DROP works everywhere
and is quieter toward attackers.

roles/fail2ban/README.md

@@ -11,7 +11,7 @@ Bans brute-force sources via UFW. Reads logs from the systemd journal (`backend
 
 - Logs to the journal (`logtarget = STDOUT` in `fail2ban.local`) — see `journalctl -u fail2ban`.
 - The systemd unit is hardened (`ProtectSystem=full`); the drop-in lives at `/etc/systemd/system/fail2ban.service.d/override.conf` and is fully managed by the role.
-- Firewall/banaction is UFW on every host; jails ban via `ufw prepend reject`.
+- Firewall/banaction is UFW on every host; jails ban via `ufw prepend deny` (DROP — no kernel `REJECT` extension needed, and it doesn't reveal the host to attackers).
 
 ## Variables
 

roles/fail2ban/defaults/main.yml

@@ -1,3 +1,4 @@
 ---
 fail2ban_firewall: ufw
 fail2ban_backend: systemd
+fail2ban_blocktype: deny

roles/fail2ban/templates/jail.local.j2

@@ -4,4 +4,5 @@ banaction  = {{fail2ban_firewall}}
 allowipv6  = true
 ignoreip   = 127.0.0.1/8
 backend    = {{fail2ban_backend}}
+blocktype  = {{fail2ban_blocktype}}
 ignoreself = true