roles/common: minor configuration of Debian 13 SSH

Tweak some of the new OpenSSH per-source penalty settings on Debian
13. For now only adjusting the source network masks and reusing the
list of IPs to exempt from fail2ban.

These being built in makes them easier to use, but I think I will
end up sticking with fail2ban for the heavy lifting because it per-
sists across restarts of the daemon, whereas OpenSSH's doesn't. I
will monitor OpenSSH on Debian 13 to see how to best use it along
side fail2ban.

roles/common/tasks/nftables.yml

@@ -9,6 +9,7 @@
     mode: "0644"
   notify:
     - Restart nftables
+    - Restart fail2ban
 
 - name: Create /etc/nftables extra config directory
   ansible.builtin.file:
@@ -19,14 +20,17 @@
 
 - name: Copy extra nftables configuration files
   ansible.builtin.copy:
-    src: firehol_level1-ipv4.nft
-    dest: /etc/nftables/firehol_level1-ipv4.nft
+    src: "{{ item.src }}"
+    dest: /etc/nftables/{{ item.src }}
     owner: root
     group: root
     mode: "0644"
-    force: false
+    force: "{{ item.force }}"
+  loop:
+    - { src: firehol_level1-ipv4.nft, force: false }
   notify:
     - Restart nftables
+    - Restart fail2ban
 
 - name: Copy nftables update scripts
   ansible.builtin.template:
@@ -36,6 +40,27 @@
     owner: root
     group: root
 
+- name: Remove deprecated data and scripts
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: absent
+  loop:
+    - /etc/nftables/spamhaus-ipv4.nft
+    - /etc/nftables/spamhaus-ipv6.nft
+    - /etc/nftables/abuseipdb-ipv4.nft
+    - /etc/nftables/abuseipdb-ipv6.nft
+    - /etc/nftables/abusech-ipv4.nft
+    - /usr/local/bin/update-abusech-nftables.sh
+    - /usr/local/bin/update-spamhaus-nftables.sh
+    - /etc/systemd/system/update-abusech-nftables.service
+    - /etc/systemd/system/update-abusech-nftables.timer
+    - /etc/systemd/system/update-spamhaus-nftables.service
+    - /etc/systemd/system/update-spamhaus-nftables.timer
+    - /usr/local/bin/aggregate-cidr-addresses.pl
+  notify:
+    - Restart nftables
+    - Restart fail2ban
+
 - name: Copy nftables systemd units
   ansible.builtin.copy:
     src: "{{ item }}"
@@ -56,9 +81,11 @@
 
 - name: Start and enable nftables update timers
   ansible.builtin.systemd_service:
-    name: update-firehol-nftables.timer
+    name: "{{ item }}"
     state: started
     enabled: true
+  loop:
+    - update-firehol-nftables.timer
 
 - name: Start and enable nftables
   ansible.builtin.systemd_service: