sjat
db1e5db138
Two bugs caught by the live make check/deploy on askari:
- include_tasks with a tag selects the include but NOT its tasks, so --tags hardening
ran nothing. Use apply: {tags:} to propagate (also fixed the firewall include).
- fail2ban service start + restart handler fail in a first-run --check (package not
installed yet); guard both with when: not ansible_check_mode so check is clean.
Applied to askari: SSH hardened, fail2ban active, ping still works (no lockout).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
25 lines
703 B
YAML
25 lines
703 B
YAML
---
|
|
- name: Install fail2ban
|
|
ansible.builtin.apt:
|
|
name: fail2ban
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Configure the sshd jail
|
|
ansible.builtin.template:
|
|
src: fail2ban_sshd.local.j2
|
|
dest: /etc/fail2ban/jail.d/sshd.local
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: restart fail2ban
|
|
|
|
- name: Enable and start fail2ban
|
|
ansible.builtin.service:
|
|
name: fail2ban
|
|
enabled: true
|
|
state: started
|
|
# In --check on a host without fail2ban yet, the package isn't really installed, so the
|
|
# service lookup fails. Skip the start in check mode (the install + jail are still
|
|
# previewed); a real deploy installs then starts it.
|
|
when: not ansible_check_mode
|