---
- name: Deploy fail2ban.local
  ansible.builtin.template:
    src: fail2ban.local
    dest: /etc/fail2ban/fail2ban.local
    owner: root
    group: root
    mode: '0644'
  notify: Reload fail2ban

- name: Deploy jail.local
  ansible.builtin.template:
    src: jail.local.j2
    dest: /etc/fail2ban/jail.local
    owner: root
    group: root
    mode: '0644'
  notify: Reload fail2ban

# ツール類の配布
- name: Deploy tools for Fail2ban
  ansible.builtin.copy:
    src: "{{ item }}"
    dest: "/usr/local/sbin"
    owner: root
    group: root
    mode: '0755'
  loop: "{{ query('ansible.builtin.fileglob', 'sbin/*') }}"

# 有効なJailに必要なフィルタのみを集約したリスト（active_actions）を生成
- name: Set active action list
  ansible.builtin.set_fact:
    active_actions: >-
      {{
        jail_action_map
        | flatten
      }}

# 有効なフィルタのみをサーバーに配置
- name: Deploy active action.d files
  ansible.builtin.template:
    src: "action.d/{{ item }}"
    dest: "/etc/fail2ban/action.d/{{ item }}"
    owner: root
    group: root
    mode: '0644'
  loop: "{{ active_actions }}"
  notify: Reload fail2ban

# ターゲットサーバー上の既存 .local ファイル一覧を取得
- name: Find existing custom action files on target
  ansible.builtin.find:
    paths: /etc/fail2ban/action.d
    patterns: "*.local"
  register: found_action_files

# active_actions に含まれていない .local ファイルを削除
- name: Remove inactive action.d files
  ansible.builtin.file:
    path: "{{ item.path }}"
    state: absent
  loop: "{{ found_action_files.files }}"
  when: (item.path | basename) not in active_actions
  loop_control:
    label: "{{ item.path }}"
  notify: Reload fail2ban

# 有効なJailに必要なフィルタのみを集約したリスト（active_filters）を生成
- name: Set active filter list
  ansible.builtin.set_fact:
    active_filters: >-
      {{
        enabled_jails
        | default([])
        | map('extract', jail_filter_map)
        | reject('undefined')
        | flatten
      }}

# 有効なフィルタのみをサーバーに配置
- name: Deploy active filter.d files
  ansible.builtin.template:
    src: "filter.d/{{ item }}"
    dest: "/etc/fail2ban/filter.d/{{ item }}"
    owner: root
    group: root
    mode: '0644'
  loop: "{{ active_filters }}"
  notify: Reload fail2ban

# ターゲットサーバー上の既存 .local ファイル一覧を取得
- name: Find existing custom filter files on target
  ansible.builtin.find:
    paths: /etc/fail2ban/filter.d
    patterns: "*.local"
  register: found_filter_files

# active_filters に含まれていない .local ファイルを削除
- name: Remove inactive filter.d files
  ansible.builtin.file:
    path: "{{ item.path }}"
    state: absent
  loop: "{{ found_filter_files.files }}"
  when: (item.path | basename) not in active_filters
  loop_control:
    label: "{{ item.path }}"
  notify: Reload fail2ban