---
# see: https://wiki.archlinux.org/title/Fail2ban
- name: Install fail2ban
  ansible.builtin.package:
    name: fail2ban
    state: present

- name: Ensure fail2ban configuration is only owned by root
  ansible.builtin.file:
    path: /etc/fail2ban
    owner: root
    group: root
    mode: "0700"
    recurse: true

- name: Deploy fail2ban main config override (log to journald)
  ansible.builtin.template:
    src: fail2ban.local.j2
    dest: /etc/fail2ban/fail2ban.local
    mode: "0600"
  notify: Restart fail2ban

- name: Install Fail2ban Config
  block:
    - name: General configuration
      ansible.builtin.template:
        src: jail.local.j2
        dest: /etc/fail2ban/jail.local
        mode: "0600"
    - name: Service custom jail
      ansible.builtin.template:
        src: "{{ item.src }}"
        dest: "{{ item.dest }}"
        mode: "0600"
      loop:
        - { src: sshd-jail.local.j2, dest: /etc/fail2ban/jail.d/sshd.local }
        - { src: nginx-jail.local.j2, dest: /etc/fail2ban/jail.d/nginx.local }

- name: Service hardening (read-only root rights)
  block:
    - name: Create configuration directory
      ansible.builtin.file:
        path: /etc/systemd/system/fail2ban.service.d
        state: directory
        owner: root
        group: root
        mode: "0700"

    - name: Apply hardening configuration
      ansible.builtin.template:
        src: hardened.fail2ban.conf.j2
        dest: /etc/systemd/system/fail2ban.service.d/override.conf
        owner: root
        group: root
        mode: "0644"
      notify: Restart fail2ban

- name: Enable UFW
  community.general.ufw:
    state: enabled

- name: Enable UFW service at startup
  ansible.builtin.systemd:
    name: ufw
    enabled: true
    state: started

- name: Start and enable fail2ban
  ansible.builtin.service:
    name: fail2ban
    state: started
    enabled: true

- name: Deploy Prometheus fail2ban exporter
  ansible.builtin.include_tasks: exporter.yml
  when: fail2ban_exporter_enabled | bool