Ensure fail2ban and logrotate are available on all machines

ansible/roles/base/tasks/fail2ban.yml

@@ -0,0 +1,25 @@
+- name: Install fail2ban
+  package:
+    name: fail2ban
+  become: true
+
+- name: Enable fail2ban
+  service:
+    name: fail2ban
+    enabled: true
+  become: true
+
+- name: fail2ban SSH jail
+  template:
+    src: files/ssh-jail.conf
+    dest: /etc/fail2ban/jail.d/ssh.conf
+    mode: "0600"
+  become: true
+  register: fail2ban_jail
+
+- name: Restart fail2ban
+  service:
+    name: fail2ban
+    state: restarted
+  become: true
+  when: fail2ban_jail.changed

ansible/roles/base/tasks/logrotate.yml

@@ -0,0 +1,18 @@
+- name: Install logrotate
+  package:
+    name: logrotate
+  become: true
+
+- name: Enable logrotate timer
+  service:
+    name: logrotate.timer
+  become: true
+  when: ansible_os_family == 'Archlinux'
+
+- name: logrotate fail2ban config
+  template:
+    src: files/fail2ban-logrotate
+    dest: /etc/logrotate.d/fail2ban
+    mode: "0600"
+  become: true
+  register: fail2ban_jail

ansible/roles/base/tasks/main.yml

@@ -6,3 +6,9 @@
 
 - name: SSH
   include: ssh.yml
+
+- name: fail2ban
+  include: fail2ban.yml
+
+- name: logrotate
+  include: logrotate.yml