common: remove fail2ban only with fail2ban_remove set for the host

common/defaults/main.yml

@@ -12,3 +12,7 @@ journald_size_cap:
   SystemMaxUse: 512M
   RuntimeMaxUse: 128M
   MaxRetentionSec: 2week
+
+# Remove fail2ban from the host (only while the CrowdSec agent and bouncer run); set with
+# -e fail2ban_remove=true once CrowdSec covers the jails of the host.
+fail2ban_remove: false

common/tasks/fail2ban.yml

@@ -1,6 +1,6 @@
 # CrowdSec reads the same logs and bans through its bouncers. fail2ban is
-# removed only where both are running, so a host never ends up without a ban
-# mechanism.
+# removed only on a host switched over on purpose (fail2ban_remove) where both
+# are running, so a host never ends up without a ban mechanism.
 - name: Check the CrowdSec services
   command: systemctl is-active crowdsec crowdsec-firewall-bouncer
   register: crowdsec_active
@@ -14,7 +14,7 @@
     name: fail2ban
     state: stopped
     enabled: false
-  when: crowdsec_active.rc == 0
+  when: fail2ban_remove and crowdsec_active.rc == 0
   failed_when: false
   tags: fail2ban
 
@@ -23,5 +23,5 @@
     name: fail2ban
     state: absent
     purge: true
-  when: crowdsec_active.rc == 0
+  when: fail2ban_remove and crowdsec_active.rc == 0
   tags: fail2ban