Clément Désiles
8756eb1183
- smartctl_exporter (disks), fail2ban exporter, wireguard exporter - grafana dashboards for each exporter - prometheus: firewall source rules, honor_labels/params scrape config - node_exporter: zfs collector - wireguard: nftables dep, resolvconf wrapper, reload fix - remove superseded monitoring role
Fail2ban
Bans brute-force sources via UFW. Reads logs from the systemd journal (backend = systemd), so it works on both Arch and Debian.
Jails
sshdnginx-http-auth
Notes
- Logs to the journal (
logtarget = STDOUTinfail2ban.local) — seejournalctl -u fail2ban. - The systemd unit is hardened (
ProtectSystem=full); the drop-in lives at/etc/systemd/system/fail2ban.service.d/override.confand is fully managed by the role. - Firewall/banaction is UFW on every host; jails ban via
ufw prepend deny(DROP — no kernelREJECTextension needed, and it doesn't reveal the host to attackers).
Variables
See defaults/main.yml.
Prometheus exporter
Optionally exposes fail2ban metrics (f2b_*) for Prometheus via
hectorjsmith/fail2ban-prometheus-exporter.
fail2ban_exporter_enabled: true
Downloads the checksum-verified static binary to /usr/local/bin and runs it
as a hardened root systemd service (required to read the root-owned socket) on
{{ fail2ban_exporter_listen_address }} (default 127.0.0.1:9191).
Verify
sudo fail2ban-client status
sudo fail2ban-client set sshd banip 192.0.2.1 && sudo ufw status | grep 192.0.2.1
sudo fail2ban-client set sshd unbanip 192.0.2.1