Read the fail2ban sshd jail from the journal, Debian 12+ has no auth.log and the jail failed to start

common/handlers/main.yml

@@ -5,3 +5,8 @@
   systemd:
     name: systemd-journald
     state: restarted
+
+- name: restart_fail2ban
+  systemd:
+    name: fail2ban
+    state: restarted

common/tasks/fail2ban.yml

@@ -0,0 +1,9 @@
+# Debian 12+ ships no syslog daemon, so there is no /var/log/auth.log and the
+# file-based sshd jail refuses to start; read sshd from the journal instead.
+- name: Read the sshd jail from the journal
+  copy:
+    dest: /etc/fail2ban/jail.d/sshd-systemd.conf
+    content: |
+      [sshd]
+      backend = systemd
+  notify: restart_fail2ban

common/tasks/main.yml

@@ -1,5 +1,7 @@
 - import_tasks: ./packages.yml
 
+- import_tasks: ./fail2ban.yml
+
 - import_tasks: ./ssh.yml
 
 - import_tasks: ./packages.yml