common: remove fail2ban where CrowdSec agent and bouncer run, stop installing it

common/tasks/fail2ban.yml

@@ -1,9 +1,27 @@
-# Debian 12+ ships no syslog daemon, so there is no /var/log/auth.log and the
-# file-based sshd jail refuses to start; read sshd from the journal instead.
-- name: Read the sshd jail from the journal
-  copy:
-    dest: /etc/fail2ban/jail.d/sshd-systemd.conf
-    content: |
-      [sshd]
-      backend = systemd
-  notify: restart_fail2ban
+# CrowdSec reads the same logs and bans through its bouncers. fail2ban is
+# removed only where both are running, so a host never ends up without a ban
+# mechanism.
+- name: Check the CrowdSec services
+  command: systemctl is-active crowdsec crowdsec-firewall-bouncer
+  register: crowdsec_active
+  changed_when: false
+  failed_when: false
+  check_mode: false
+  tags: fail2ban
+
+- name: Stop and disable fail2ban
+  systemd:
+    name: fail2ban
+    state: stopped
+    enabled: false
+  when: crowdsec_active.rc == 0
+  failed_when: false
+  tags: fail2ban
+
+- name: Remove fail2ban
+  apt:
+    name: fail2ban
+    state: absent
+    purge: true
+  when: crowdsec_active.rc == 0
+  tags: fail2ban