Remove Debian 10 support

roles/common/tasks/fail2ban.yml

@@ -1,27 +1,45 @@
 ---
-
 - name: Configure fail2ban sshd filter
-  ansible.builtin.template: src=etc/fail2ban/jail.d/sshd.local.j2 dest=/etc/fail2ban/jail.d/sshd.local owner=root mode=0644
+  ansible.builtin.template:
+    src: etc/fail2ban/jail.d/sshd.local.j2
+    dest: /etc/fail2ban/jail.d/sshd.local
+    owner: root
+    mode: 0644
   notify: restart fail2ban
 
 - name: Configure fail2ban nginx filter
   when:
     - extra_fail2ban_filters is defined
     - "'nginx' in extra_fail2ban_filters"
-  ansible.builtin.template: src=etc/fail2ban/jail.d/nginx.local.j2 dest=/etc/fail2ban/jail.d/nginx.local owner=root mode=0644
+  ansible.builtin.template:
+    src: etc/fail2ban/jail.d/nginx.local.j2
+    dest: /etc/fail2ban/jail.d/nginx.local
+    owner: root
+    mode: 0644
   notify: restart fail2ban
 
 - name: Create fail2ban service override directory
-  ansible.builtin.file: path=/etc/systemd/system/fail2ban.service.d state=directory owner=root mode=0755
+  ansible.builtin.file:
+    path: /etc/systemd/system/fail2ban.service.d
+    state: directory
+    owner: root
+    mode: 0755
 
 # See Arch Linux's example: https://wiki.archlinux.org/index.php/Fail2ban
 - name: Configure fail2ban service override
-  ansible.builtin.template: src=etc/systemd/system/fail2ban.service.d/override.conf.j2 dest=/etc/systemd/system/fail2ban.service.d/override.conf owner=root mode=0644
+  ansible.builtin.template:
+    src: etc/systemd/system/fail2ban.service.d/override.conf.j2
+    dest: /etc/systemd/system/fail2ban.service.d/override.conf
+    owner: root
+    mode: 0644
   notify:
     - reload systemd
     - restart fail2ban
 
 - name: Start and enable fail2ban service
-  ansible.builtin.systemd: name=fail2ban state=started enabled=true
+  ansible.builtin.systemd:
+    name: fail2ban
+    state: started
+    enabled: true
 
 # vim: set sw=2 ts=2:

roles/common/tasks/firewall_Debian.yml

@@ -1,17 +1,7 @@
 ---
-# Debian 10 will use firewalld with the iptables backend.
 # Debian 11 will use nftables directly, with no firewalld.
 
 - block:
-  - name: Set Debian firewall packages
-    when: ansible_distribution_major_version is version('10', '<=')
-    ansible.builtin.set_fact:
-      debian_firewall_packages:
-        - firewalld
-        - tidy
-        - fail2ban
-        - python3-systemd # for fail2ban systemd backend
-
   - name: Set Debian firewall packages
     when: ansible_distribution_major_version is version('11', '>=')
     ansible.builtin.set_fact:
@@ -53,64 +43,6 @@
       - restart nftables
       - restart fail2ban
 
-  - name: Use iptables backend in firewalld
-    when: ansible_distribution_major_version is version('10', '==')
-    ansible.builtin.lineinfile:
-      dest: /etc/firewalld/firewalld.conf
-      regexp: '^FirewallBackend=nftables$'
-      line: 'FirewallBackend=iptables'
-    notify:
-      - restart firewalld
-      - restart fail2ban
-
-# firewalld seems to have an issue with iptables 1.8.2 when using the nftables
-# backend. Using individual calls seems to work around it.
-# See: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931722
-  - name: Use individual iptables calls
-    when: ansible_distribution_major_version is version('10', '==')
-    ansible.builtin.lineinfile:
-      dest: /etc/firewalld/firewalld.conf
-      regexp: '^IndividualCalls=no$'
-      line: 'IndividualCalls=yes'
-    notify:
-      - restart firewalld
-      - restart fail2ban
-
-  - name: Copy firewalld public zone file
-    when: ansible_distribution_major_version is version('10', '<=')
-    ansible.builtin.template: src=public.xml.j2 dest=/etc/firewalld/zones/public.xml owner=root mode=0600
-
-  - name: Format public.xml firewalld zone file
-    when: ansible_distribution_major_version is version('10', '<=')
-    command: tidy -xml -iq -m -w 0 /etc/firewalld/zones/public.xml
-    notify:
-      - restart firewalld
-      - restart fail2ban
-
-  - name: Copy firewalld ipsets of abusive IPs
-    when: ansible_distribution_major_version is version('10', '<=')
-    ansible.builtin.copy: src={{ item }} dest=/etc/firewalld/ipsets/{{ item }} owner=root group=root mode=0600
-    loop:
-      - abusers-ipv4.xml
-      - abusers-ipv6.xml
-      - spamhaus-ipv4.xml
-      - spamhaus-ipv6.xml
-    notify:
-      - restart firewalld
-      - restart fail2ban
-
-  - name: Copy Spamhaus firewalld update script
-    when: ansible_distribution_version is version('10', '<=')
-    ansible.builtin.copy: src=update-spamhaus-lists.sh dest=/usr/local/bin/update-spamhaus-lists.sh mode=0755 owner=root group=root
-
-  - name: Copy Spamhaus firewalld systemd units
-    when: ansible_distribution_version is version('10', '<=')
-    ansible.builtin.copy: src={{ item }} dest=/etc/systemd/system/{{ item }} mode=0644 owner=root group=root
-    loop:
-        - update-spamhaus-lists.service
-        - update-spamhaus-lists.timer
-    register: spamhaus_firewalld_systemd_units
-
   - name: Copy Spamhaus nftables update scripts
     when: ansible_distribution_version is version('11', '>=')
     ansible.builtin.copy: src={{ item }} dest=/usr/local/bin/{{ item }} mode=0755 owner=root group=root
@@ -132,15 +64,7 @@
   # need to reload to pick up service/timer/environment changes
   - name: Reload systemd daemon
     ansible.builtin.systemd: daemon_reload=true
-    when: spamhaus_firewalld_systemd_units is changed or
-          nftables_systemd_units is changed
-
-  - name: Start and enable Spamhaus firewalld update timer
-    when: ansible_distribution_version is version('10', '<=')
-    ansible.builtin.systemd: name=update-spamhaus-lists.timer state=started enabled=true
-    notify:
-      - restart firewalld
-      - restart fail2ban
+    when: nftables_systemd_units is changed
 
   - name: Start and enable nftables update timers
     when: ansible_distribution_version is version('11', '>=')