---
- name: "Install EPEL release on RedHat-family systems"
  ansible.builtin.dnf:
    name: "epel-release"
    state: present

- name: "Install fail2ban"
  ansible.builtin.package:
    name: "fail2ban"
    state: present

- name: "Ensure Fail2Ban jail configuration directory exists"
  ansible.builtin.file:
    path: /etc/fail2ban/jail.d
    state: directory
    owner: root
    group: root
    mode: "0755"

- name: "Render sshd jail configuration"
  notify: Restart fail2ban
  ansible.builtin.template:
    src: sshd.conf.j2
    dest: /etc/fail2ban/jail.d/sshd.local
    owner: root
    group: root
    mode: "0644"