From 19a62a43ca101f9da4fbdd425a52a57b6e85aff6 Mon Sep 17 00:00:00 2001
From: Ruakij <ruakij@ruekov.eu>
Date: Sat, 24 Oct 2026 15:57:34 +0000
Subject: [PATCH] common: remove fail2ban where CrowdSec agent and bouncer run,
 stop installing it

---
 common/handlers/main.yml  |  5 -----
 common/tasks/fail2ban.yml | 36 +++++++++++++++++++++++++++---------
 common/tasks/packages.yml |  1 -
 3 files changed, 27 insertions(+), 15 deletions(-)

diff --git a/common/handlers/main.yml b/common/handlers/main.yml
index 46df04c..e77d0ef 100644
--- a/common/handlers/main.yml
+++ b/common/handlers/main.yml
@@ -5,8 +5,3 @@
   systemd:
     name: systemd-journald
     state: restarted
-
-- name: restart_fail2ban
-  systemd:
-    name: fail2ban
-    state: restarted
diff --git a/common/tasks/fail2ban.yml b/common/tasks/fail2ban.yml
index 8b2fab8..421bd02 100644
--- a/common/tasks/fail2ban.yml
+++ b/common/tasks/fail2ban.yml
@@ -1,9 +1,27 @@
-# Debian 12+ ships no syslog daemon, so there is no /var/log/auth.log and the
-# file-based sshd jail refuses to start; read sshd from the journal instead.
-- name: Read the sshd jail from the journal
-  copy:
-    dest: /etc/fail2ban/jail.d/sshd-systemd.conf
-    content: |
-      [sshd]
-      backend = systemd
-  notify: restart_fail2ban
+# CrowdSec reads the same logs and bans through its bouncers. fail2ban is
+# removed only where both are running, so a host never ends up without a ban
+# mechanism.
+- name: Check the CrowdSec services
+  command: systemctl is-active crowdsec crowdsec-firewall-bouncer
+  register: crowdsec_active
+  changed_when: false
+  failed_when: false
+  check_mode: false
+  tags: fail2ban
+
+- name: Stop and disable fail2ban
+  systemd:
+    name: fail2ban
+    state: stopped
+    enabled: false
+  when: crowdsec_active.rc == 0
+  failed_when: false
+  tags: fail2ban
+
+- name: Remove fail2ban
+  apt:
+    name: fail2ban
+    state: absent
+    purge: true
+  when: crowdsec_active.rc == 0
+  tags: fail2ban
diff --git a/common/tasks/packages.yml b/common/tasks/packages.yml
index bd70caa..656a2e9 100644
--- a/common/tasks/packages.yml
+++ b/common/tasks/packages.yml
@@ -16,5 +16,4 @@
       - curl
       - rsync
       - zstd
-      - fail2ban
     state: latest