roles/common: rework fail2ban tasks

We can only run fail2ban when we have logs to monitor. When a host
is running Caddy we don't have logs, so fail2ban doesn't have any-
thing to monitor out of the box. For now I will restrict the task
to hosts running nginx.

roles/common/handlers/main.yml

@@ -25,3 +25,4 @@
   ansible.builtin.systemd:
     name: fail2ban
     state: restarted
+  when: webserver is defined and webserver == 'nginx'

roles/common/tasks/fail2ban.yml

@@ -1,4 +1,15 @@
 ---
+- name: Install fail2ban
+  when:
+    - ansible_distribution_major_version is version('11', '>=')
+    - webserver is defined and webserver == 'nginx'
+  ansible.builtin.package:
+    name:
+      - fail2ban
+      - python3-systemd
+    state: present
+    cache_valid_time: 3600
+
 - name: Configure fail2ban sshd filter
   ansible.builtin.template:
     src: etc/fail2ban/jail.d/sshd.local.j2

roles/common/tasks/firewall_Debian.yml

@@ -6,10 +6,8 @@
       when: ansible_distribution_major_version is version('11', '>=')
       ansible.builtin.package:
         name:
-          - fail2ban
           - libnet-ip-perl # for aggregate-cidr-addresses.pl
           - nftables
-          - python3-systemd
           - curl # for nftables update scripts
         state: present
         cache_valid_time: 3600
@@ -109,8 +107,12 @@
         state: started
         enabled: true
 
+    # We only install fail2ban on systems running nginx. If the host is running
+    # Caddy then there are no logs for us to monitor.
     - ansible.builtin.include_tasks: fail2ban.yml
-      when: ansible_distribution_major_version is version('9', '>=')
+      when:
+        - ansible_distribution_major_version is version('9', '>=')
+        - webserver is defined and webserver == 'nginx'
   tags: firewall
 
 # vim: set sw=2 ts=2:

roles/common/tasks/firewall_Ubuntu.yml

@@ -3,12 +3,11 @@
 
 - block:
     - name: Install Ubuntu firewall packages
+      when: ansible_distribution_version is version('20.04', '>=')
       ansible.builtin.package:
         name:
-          - fail2ban
           - libnet-ip-perl # for aggregate-cidr-addresses.pl
           - nftables
-          - python3-systemd
           - curl # for nftables update scripts
         state: present
         cache_valid_time: 3600
@@ -107,8 +106,12 @@
         state: started
         enabled: true
 
+    # We only install fail2ban on systems running nginx. If the host is running
+    # Caddy then there are no logs for us to monitor.
     - ansible.builtin.include_tasks: fail2ban.yml
-      when: ansible_distribution_version is version('16.04', '>=')
+      when:
+        - ansible_distribution_version is version('16.04', '>=')
+        - webserver is defined and webserver == 'nginx'
   tags: firewall
 
 # vim: set sw=2 ts=2: