---
- name: Harden SSH configuration
  become: true
  block:
    - name: Create SSH drop-in directory
      ansible.builtin.file:
        path: /etc/ssh/sshd_config.d
        state: directory
        owner: root
        group: root
        mode: "0755"

    - name: Harden SSH configuration with drop-in template
      ansible.builtin.template:
        src: sshd.conf.j2
        dest: /etc/ssh/sshd_config.d/sshd.conf
        owner: root
        group: root
        mode: "0644"
      notify: Restart sshd

- name: Enable fail2ban
  become: true
  block:
    - name: Install fail2ban
      ansible.builtin.apt:
        name:
          - fail2ban
        state: present

    - name: Start fail2ban
      ansible.builtin.service:
        name: fail2ban
        state: started
        enabled: yes