fail2ban

The fail2ban role installs fail2ban, reads the systemd journal and bans through nftables. It writes one file, /etc/fail2ban/jail.d/50-noixdev.local; the packaged jail.conf stays untouched.

What it does

Installs fail2ban and nftables (fail2ban_packages).
Checks that every entry of security_allowlist and fail2ban_ignoreip is an IP address or CIDR, and stops the run if one is not.
Writes the jail file: journal backend, nftables ban actions, bantime 1h, findtime 10m, maxretry 5.
Enables the sshd jail, which watches base_sshd_port (22 when that variable is not defined).
Enables the recidive jail, which bans hosts that are banned again and again for a week, on every port.

Key variables

Variable	Default	Meaning
`security_allowlist`	`[]`	Management networks never banned. Shared with `crowdsec`. See the lockout guard.
`fail2ban_ignoreip`	loopback	Further addresses never banned.
`fail2ban_bantime`	`1h`	Default ban duration.
`fail2ban_findtime`	`10m`	Window for `fail2ban_maxretry` failures.
`fail2ban_maxretry`	`5`	Failures before a ban.
`fail2ban_sshd`	`true`	Enable the sshd jail.
`fail2ban_sshd_port`	`base_sshd_port` or 22	Port(s) the sshd jail bans.
`fail2ban_recidive`	`true`	Enable the recidive jail.
`fail2ban_extra_jails`	`[]`	Further jails.

All variables: fail2ban in the reference.

Example

- hosts: servers
  become: true
  vars:
    security_allowlist: [192.0.2.0/24, 2001:db8::/32]
  roles:
    - noixdev.infra.base
    - role: noixdev.infra.fail2ban
      vars:
        fail2ban_maxretry: 3
        fail2ban_extra_jails:
          - name: nginx-http-auth
            enabled: true
            port: http,https
            backend: auto
            logpath: /var/log/nginx/error.log

Each entry of fail2ban_extra_jails is a dict with name and the jail’s options (enabled, port, filter, logpath, backend and so on). Booleans are written as true or false.

Gotchas

Fill security_allowlist before you apply the role. A banned management address cannot log in.
Run it after base. The sshd jail relies on the LogLevel VERBOSE setting that base writes, and follows base_sshd_port. If sshd runs on another port without base, set fail2ban_sshd_port.
Do not run fail2ban and CrowdSec for the same job without thinking. Both can ban SSH failures. They are designed to coexist and share the allowlist; use one or both deliberately.
fail2ban does not cover published Docker ports. Traffic to them bypasses the INPUT chain. The crowdsec role’s bouncer guards DOCKER-USER as well.