boma/roles/base/handlers/main.yml

---
- name: Reload sshd
  listen: reload sshd
  ansible.builtin.service:
    name: ssh
    state: reloaded

- name: Restart fail2ban
  listen: restart fail2ban
  ansible.builtin.service:
    name: fail2ban
    state: restarted
  when: not ansible_check_mode   # fail2ban isn't installed during a first-run --check
feat(base): scaffold role + meta/README (firewall concern incoming) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> 2026-06-06 18:48:35 +02:00			`---`
feat(base): ssh hardening + fail2ban (hardening concern, ADR-002) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> 2026-06-14 16:42:56 +02:00			`- name: Reload sshd`
			`listen: reload sshd`
			`ansible.builtin.service:`
			`name: ssh`
			`state: reloaded`

			`- name: Restart fail2ban`
			`listen: restart fail2ban`
			`ansible.builtin.service:`
			`name: fail2ban`
			`state: restarted`
fix(base): propagate hardening tag to included tasks; check-mode-safe fail2ban Two bugs caught by the live make check/deploy on askari: - include_tasks with a tag selects the include but NOT its tasks, so --tags hardening ran nothing. Use apply: {tags:} to propagate (also fixed the firewall include). - fail2ban service start + restart handler fail in a first-run --check (package not installed yet); guard both with when: not ansible_check_mode so check is clean. Applied to askari: SSH hardened, fail2ban active, ping still works (no lockout). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> 2026-06-14 16:54:23 +02:00			`when: not ansible_check_mode # fail2ban isn't installed during a first-run --check`