roles/common: use ansible.builtin.apt module

On Debian 12 we need to explicitly remove ntp because it does not
conflict with other time daemons.

roles/common/tasks/fail2ban.yml

@@ -1,7 +1,7 @@
 ---
 - name: Install fail2ban
   when: ansible_distribution_major_version is version('11', '>=')
-  ansible.builtin.package:
+  ansible.builtin.apt:
     name:
       - fail2ban
       - python3-systemd

roles/common/tasks/firewall.yml

@@ -3,7 +3,7 @@
 
 - name: Install Debian firewall packages
   when: ansible_distribution_major_version is version('11', '>=')
-  ansible.builtin.package:
+  ansible.builtin.apt:
     name: nftables
     state: present
     cache_valid_time: 3600

roles/common/tasks/ntp.yml

@@ -12,11 +12,9 @@
 
 # Apparently some cloud images don't have this installed by default. From what
 # I can see on existing servers, systemd-timesyncd is a standalone package on
-# Debian 11.
+# Debian 11 and Debian 12.
 - name: Install systemd-timesyncd
-  when:
-    - ansible_distribution == 'Debian'
-    - ansible_distribution_version is version('11', '>='))
+  when: ansible_distribution_version is version('11', '>=')
   ansible.builtin.apt:
     name: systemd-timesyncd
     state: present
@@ -29,8 +27,12 @@
     state: started
     enabled: true
 
-- name: Uninstall ntp on modern Debian
-  when: ansible_service_mgr == 'systemd'
+# On Debian 12 ntp doesn't conflict with systemd-timesyncd so we should try to
+# remove it to be sure.
+- name: Uninstall ntp on Debian 12
+  when:
+    - ansible_service_mgr == 'systemd'
+    - ansible_distribution_major_version is version('12', '==')
   ansible.builtin.apt:
     name: ntp
     state: absent