- name: Install fail2ban
  apt:
    name: fail2ban
    state: present
    update_cache: true

- name: Configure jail.local
  template:
    src: jail.local.j2
    dest: /etc/fail2ban/jail.local
    mode: 0644
  notify: Restart fail2ban

- name: Configure nginx filter
  template:
    src: nginx.conf.j2
    dest: /etc/fail2ban/filter.d/nginx-http-auth.conf
    mode: 0644
  when: fail2ban_nginx_enabled

- name: Ensure fail2ban is running
  service:
    name: fail2ban
    state: started
    enabled: true