Initial ansible onboard

ansible/roles/fail2ban/tasks/install_debian.yml

@@ -0,0 +1,12 @@
+---
+
+- name: 'INSTALL | APT | Install fail2ban packages'
+  ansible.builtin.apt:
+    name: "{{ item.name }}"
+    state: "{{ item.state | default('present') }}"
+    update_cache: "{{ fail2ban_repository_update_cache }}"
+    cache_valid_time: "{{ fail2ban_repository_cache_valid_time }}"
+  become: true
+  with_items: "{{ fail2ban_packages }}"
+  notify:
+    - 'HANDLER | Restart fail2ban'

ansible/roles/fail2ban/tasks/install_redhat.yml

@@ -0,0 +1,9 @@
+---
+- name: "INSTALL | YUM | Install fail2ban packages"
+  ansible.builtin.dnf:
+    name: "{{ item.name }}"
+    state: "{{ item.state | default('present') }}"
+  with_items: "{{ fail2ban_packages }}"
+  become: true
+  notify:
+    - "HANDLER | Restart fail2ban"

ansible/roles/fail2ban/tasks/main.yml

@@ -0,0 +1,32 @@
+---
+
+# Main tasks file for fail2ban role
+
+- name: 'INIT | Manage variables to use for our target'
+  ansible.builtin.import_tasks: "{{ role_path }}/tasks/manage_variables.yml"
+  tags:
+    - 'role::fail2ban'
+    - 'role::fail2ban::config'
+    - 'role::fail2ban::install'
+
+
+- name: 'INSTALL | Manage install on family OS'
+  ansible.builtin.include_tasks: "{{ role_path }}/tasks/install_{{ ansible_os_family | lower }}.yml"
+  tags:
+    - 'role::fail2ban'
+    - 'role::fail2ban::install'
+
+
+- name: 'CONFIG | Include configuration tasks'
+  ansible.builtin.import_tasks: "{{ role_path }}/tasks/manage_config.yml"
+  tags:
+    - 'role::fail2ban'
+    - 'role::fail2ban::config'
+
+
+- name: 'SERVICE | Include services tasks'
+  ansible.builtin.import_tasks: "{{ role_path }}/tasks/manage_service.yml"
+  tags:
+    - 'role::fail2ban'
+    - 'role::fail2ban::install'
+    - 'role::fail2ban::service'

ansible/roles/fail2ban/tasks/manage_config.yml

@@ -0,0 +1,79 @@
+---
+
+# Configuration tasks file for fail2ban
+# =============================================================================
+
+- name: 'CONFIG | PATHS | Ensure main configuration folder exists'
+  ansible.builtin.file:
+    dest: "{{ fail2ban_paths.folders.main.path }}"
+    owner: "{{ fail2ban_paths.folders.main.owner | default('root') }}"
+    group: "{{ fail2ban_paths.folders.main.group | default('root') }}"
+    mode: "{{ fail2ban_paths.folders.main.mode | default('0755') }}"
+    state: 'directory'
+
+
+- name: 'CONFIG | Ensure actions folder exists'
+  ansible.builtin.file:
+    dest: "{{ fail2ban_paths.folders.action.path }}"
+    owner: "{{ fail2ban_paths.folders.action.owner | default('root') }}"
+    group: "{{ fail2ban_paths.folders.action.group | default('root') }}"
+    mode: "{{ fail2ban_paths.folders.action.mode | default('0755') }}"
+    state: 'directory'
+
+
+- name: 'CONFIG | Ensure filters folder exists'
+  ansible.builtin.file:
+    dest: "{{ fail2ban_paths.folders.filter.path }}"
+    owner: "{{ fail2ban_paths.folders.filter.owner | default('root') }}"
+    group: "{{ fail2ban_paths.folders.filter.group | default('root') }}"
+    mode: "{{ fail2ban_paths.folders.filter.mode | default('0755') }}"
+    state: 'directory'
+
+
+- name: 'CONFIG | Manage main configuration file'
+  community.general.ini_file:
+    dest: "{{ fail2ban_paths.files.main_config.path }}"
+    owner: "{{ fail2ban_paths.files.main_config.owner | default('root') }}"
+    group: "{{ fail2ban_paths.files.main_config.group | default('root') }}"
+    mode: "{{ fail2ban_paths.files.main_config.mode | default('0644') }}"
+    section: "{{ item.section | default('Definition') }}"
+    option: "{{ item.option }}"
+    value: "{{ item.value }}"
+  notify: 'HANDLER | Restart fail2ban'
+  with_items: "{{ fail2ban_main_config_content }}"
+  become: true
+
+
+- name: 'CONFIG | Manage actions configurations files'
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/action.conf.j2"
+    dest: "{{ fail2ban_paths.folders.action.path }}/{{ item.key }}.conf"
+    owner: "{{ fail2ban_paths.files.action.owner | default('root') }}"
+    group: "{{ fail2ban_paths.files.action.group | default('root') }}"
+    mode: "{{ fail2ban_paths.files.action.mode | default('0644') }}"
+  notify: 'HANDLER | Restart fail2ban'
+  with_dict: "{{ fail2ban_actions }}"
+  become: true
+
+
+- name: 'CONFIG | Manage filters configurations files'
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/filter.conf.j2"
+    dest: "{{ fail2ban_paths.folders.filter.path }}/{{ item.key }}.conf"
+    owner: "{{ fail2ban_paths.files.filter.owner | default('root') }}"
+    group: "{{ fail2ban_paths.files.filter.group | default('root') }}"
+    mode: "{{ fail2ban_paths.files.filter.mode | default('0644') }}"
+  notify: 'HANDLER | Restart fail2ban'
+  with_dict: "{{ fail2ban_filters }}"
+  become: true
+
+
+- name: 'CONFIG | Manage local jails configuration file'
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/jail.local.j2"
+    dest: "{{ fail2ban_paths.files.jail_local.path }}"
+    owner: "{{ fail2ban_paths.files.jail_local.owner | default('root') }}"
+    group: "{{ fail2ban_paths.files.jail_local.group | default('root') }}"
+    mode: "{{ fail2ban_paths.files.jail_local.mode | default('0644') }}"
+  notify: 'HANDLER | Restart fail2ban'
+  become: true

ansible/roles/fail2ban/tasks/manage_service.yml

@@ -0,0 +1,11 @@
+---
+# Service tasks file for fail2ban
+# =============================================================================
+
+- name: "SERVICE | Manage service state"
+  ansible.builtin.service:
+    name: "{{ fail2ban_service_name }}"
+    state: "{{ fail2ban_service_state }}"
+    enabled: "{{ fail2ban_service_enabled }}"
+  become: true
+  when: molecule_yml is not defined

ansible/roles/fail2ban/tasks/manage_variables.yml

@@ -0,0 +1,41 @@
+---
+
+# All tasks about variables management
+
+- name: 'INIT | VARIABLES | Check if OS family vars file exists'
+  become: false
+  ansible.builtin.stat:
+    path: "{{ role_path }}/vars/os_family/{{ ansible_os_family | lower }}.yml"
+  register: 'fail2ban_check_os_family_vars'
+  delegate_to: '127.0.0.1'
+
+
+- name: 'INIT | VARIABLES | Check if OS distribution vars file exists'
+  become: false
+  ansible.builtin.stat:
+    path: "{{ role_path }}/vars/os_distribution/{{ ansible_distribution | lower }}.yml"
+  register: 'fail2ban_check_os_distribution_vars'
+  delegate_to: '127.0.0.1'
+
+
+- name: 'INIT | VARIABLES | Check if OS release vars file exists'
+  become: false
+  ansible.builtin.stat:
+    path: "{{ role_path }}/vars/os_distribution/{{ ansible_distribution | lower }}/{{ ansible_distribution_release | lower }}.yml"
+  register: 'fail2ban_check_os_release_vars'
+  delegate_to: '127.0.0.1'
+
+
+- name: 'INIT | VARIABLES | Load OS family vars file'
+  ansible.builtin.include_vars: "{{ role_path }}/vars/os_family/{{ ansible_os_family | lower }}.yml"
+  when: "fail2ban_check_os_family_vars.stat.exists"
+
+
+- name: 'INIT | VARIABLES | Load OS distribution vars file'
+  ansible.builtin.include_vars: "{{ role_path }}/vars/os_distribution/{{ ansible_distribution | lower }}.yml"
+  when: "fail2ban_check_os_distribution_vars.stat.exists"
+
+
+- name: 'INIT | VARIABLES | Load OS release vars file'
+  ansible.builtin.include_vars: "{{ role_path }}/vars/os_distribution/{{ ansible_distribution | lower }}/{{ ansible_distribution_release | lower }}.yml"
+  when: "fail2ban_check_os_release_vars.stat.exists"