common: remove fail2ban only with fail2ban_remove set for the host

2026-10-24 16:11:36 +00:00
parent c36f269406
commit 49834b858b
2 changed files with 8 additions and 4 deletions
@@ -1,6 +1,6 @@
 # CrowdSec reads the same logs and bans through its bouncers. fail2ban is
-# removed only where both are running, so a host never ends up without a ban
-# mechanism.
+# removed only on a host switched over on purpose (fail2ban_remove) where both
+# are running, so a host never ends up without a ban mechanism.
 - name: Check the CrowdSec services
  command: systemctl is-active crowdsec crowdsec-firewall-bouncer
  register: crowdsec_active
@@ -14,7 +14,7 @@
    name: fail2ban
    state: stopped
    enabled: false
-  when: crowdsec_active.rc == 0
+  when: fail2ban_remove and crowdsec_active.rc == 0
  failed_when: false
  tags: fail2ban

@@ -23,5 +23,5 @@
    name: fail2ban
    state: absent
    purge: true
-  when: crowdsec_active.rc == 0
+  when: fail2ban_remove and crowdsec_active.rc == 0
  tags: fail2ban