---
- name: Harden SSH configuration
  ansible.builtin.import_role:
    name: devsec.hardening.ssh_hardening
  vars:
    ssh_permit_root_login: "no"
    ssh_password_authentication: "no"

- name: Install fail2ban
  ansible.builtin.apt:
    name:
      - fail2ban
    state: present
  become: true

- name: Start fail2ban
  ansible.builtin.service:
    name: fail2ban
    state: started
    enabled: yes