108 lines
2.9 KiB
YAML
108 lines
2.9 KiB
YAML
---
|
||
- name: Deploy fail2ban.local
|
||
ansible.builtin.template:
|
||
src: fail2ban.local
|
||
dest: /etc/fail2ban/fail2ban.local
|
||
owner: root
|
||
group: root
|
||
mode: '0644'
|
||
notify: Reload fail2ban
|
||
|
||
- name: Deploy jail.local
|
||
ansible.builtin.template:
|
||
src: jail.local.j2
|
||
dest: /etc/fail2ban/jail.local
|
||
owner: root
|
||
group: root
|
||
mode: '0644'
|
||
notify: Reload fail2ban
|
||
|
||
# ツール類の配布
|
||
- name: Deploy tools for Fail2ban
|
||
ansible.builtin.copy:
|
||
src: "{{ item }}"
|
||
dest: "/usr/local/sbin"
|
||
owner: root
|
||
group: root
|
||
mode: '0755'
|
||
loop: "{{ query('ansible.builtin.fileglob', 'sbin/*') }}"
|
||
|
||
# 有効なJailに必要なフィルタのみを集約したリスト（active_actions）を生成
|
||
- name: Set active action list
|
||
ansible.builtin.set_fact:
|
||
active_actions: >-
|
||
{{
|
||
jail_action_map
|
||
| flatten
|
||
}}
|
||
|
||
# 有効なフィルタのみをサーバーに配置
|
||
- name: Deploy active action.d files
|
||
ansible.builtin.template:
|
||
src: "action.d/{{ item }}"
|
||
dest: "/etc/fail2ban/action.d/{{ item }}"
|
||
owner: root
|
||
group: root
|
||
mode: '0644'
|
||
loop: "{{ active_actions }}"
|
||
notify: Reload fail2ban
|
||
|
||
# ターゲットサーバー上の既存 .local ファイル一覧を取得
|
||
- name: Find existing custom action files on target
|
||
ansible.builtin.find:
|
||
paths: /etc/fail2ban/action.d
|
||
patterns: "*.local"
|
||
register: found_action_files
|
||
|
||
# active_actions に含まれていない .local ファイルを削除
|
||
- name: Remove inactive action.d files
|
||
ansible.builtin.file:
|
||
path: "{{ item.path }}"
|
||
state: absent
|
||
loop: "{{ found_action_files.files }}"
|
||
when: (item.path | basename) not in active_actions
|
||
loop_control:
|
||
label: "{{ item.path }}"
|
||
notify: Reload fail2ban
|
||
|
||
# 有効なJailに必要なフィルタのみを集約したリスト（active_filters）を生成
|
||
- name: Set active filter list
|
||
ansible.builtin.set_fact:
|
||
active_filters: >-
|
||
{{
|
||
enabled_jails
|
||
| default([])
|
||
| map('extract', jail_filter_map)
|
||
| reject('undefined')
|
||
| flatten
|
||
}}
|
||
|
||
# 有効なフィルタのみをサーバーに配置
|
||
- name: Deploy active filter.d files
|
||
ansible.builtin.template:
|
||
src: "filter.d/{{ item }}"
|
||
dest: "/etc/fail2ban/filter.d/{{ item }}"
|
||
owner: root
|
||
group: root
|
||
mode: '0644'
|
||
loop: "{{ active_filters }}"
|
||
notify: Reload fail2ban
|
||
|
||
# ターゲットサーバー上の既存 .local ファイル一覧を取得
|
||
- name: Find existing custom filter files on target
|
||
ansible.builtin.find:
|
||
paths: /etc/fail2ban/filter.d
|
||
patterns: "*.local"
|
||
register: found_filter_files
|
||
|
||
# active_filters に含まれていない .local ファイルを削除
|
||
- name: Remove inactive filter.d files
|
||
ansible.builtin.file:
|
||
path: "{{ item.path }}"
|
||
state: absent
|
||
loop: "{{ found_filter_files.files }}"
|
||
when: (item.path | basename) not in active_filters
|
||
loop_control:
|
||
label: "{{ item.path }}"
|
||
notify: Reload fail2ban
|