---
- name: Install fail2ban and configure sshd
  hosts: "{{ my_hosts | d([]) }}"
  become: true

  tasks:
    - name: Install fail2ban
      ansible.builtin.apt:
        name:
          - fail2ban
        update_cache: true

    - name: Copy fail2ban config file
      ansible.builtin.copy:
        src: configfiles/debian-sshd-default.conf
        dest: /etc/fail2ban/jail.d/debian-sshd-default.conf
        mode: '0644'
        owner: root
        group: root

    - name: Restart fail2ban
      ansible.builtin.systemd_service:
        state: restarted
        daemon_reload: true
        name: fail2ban