roles/common: notify fail2ban after updating firewall

We should always restart fail2ban after updating the firewall. Also
note that the order of execution of handlers depends on how they are
defined in the handler config, not on the order they are listed in
the task's notify statement.

See: https://docs.ansible.com/ansible/latest/user_guide/playbooks_handlers.html

roles/common/files/abuseipdb-ipv6.nft

@@ -1,7 +1,5 @@
 #!/usr/sbin/nft -f
 
 define ABUSEIPDB_IPV6 = {
-2400:6180:0:d1::4ce:d001,
+fe80::bca2:37fa:fe58:414e
-2607:5300:60:232d::,
-2607:f298:6:a066::1bf:e80e,
 }

roles/common/files/abusers-ipv6.xml

@@ -3,7 +3,4 @@
   <option name="family" value="inet6" />
   <short>abusers-ipv6</short>
   <description>A list of abusive IPv6 addresses.</description>
-  <entry>2400:6180:0:d1::4ce:d001</entry>
-  <entry>2607:5300:60:232d::</entry>
-  <entry>2607:f298:6:a066::1bf:e80e</entry>
 </ipset>

roles/common/handlers/main.yml

@@ -10,11 +10,14 @@
 - name: restart firewalld
   systemd: name=firewalld state=restarted
 
-- name: restart fail2ban
-  systemd: name=fail2ban state=restarted
-
 - name: reload systemd
   systemd: daemon_reload=yes
 
 - name: restart nftables
   systemd: name=nftables state=restarted
+
+# 2021-09-28: note to self to keep fail2ban at the end, as handlers are executed
+# in the order they are defined, not in the order they are listed in the task's
+# notify statement and we must restart fail2ban after updating the firewall.
+- name: restart fail2ban
+  systemd: name=fail2ban state=restarted

roles/common/tasks/firewall_Debian.yml

@@ -34,6 +34,7 @@
     template: src=nftables.conf.j2 dest=/etc/nftables.conf owner=root mode=0644
     notify:
       - restart nftables
+      - restart fail2ban
 
   - name: Create /etc/nftables extra config directory
     when: ansible_distribution_major_version is version('11', '>=')
@@ -50,6 +51,7 @@
       - { src: "abuseipdb-ipv6.nft", force: "yes" }
     notify:
       - restart nftables
+      - restart fail2ban
 
   - name: Use iptables backend in firewalld
     when: ansible_distribution_major_version is version('10', '==')
@@ -59,6 +61,7 @@
       line: 'FirewallBackend=iptables'
     notify:
       - restart firewalld
+      - restart fail2ban
 
 # firewalld seems to have an issue with iptables 1.8.2 when using the nftables
 # backend. Using individual calls seems to work around it.
@@ -71,6 +74,7 @@
       line: 'IndividualCalls=yes'
     notify:
       - restart firewalld
+      - restart fail2ban
 
   - name: Copy firewalld public zone file
     when: ansible_distribution_major_version is version('10', '<=')
@@ -81,6 +85,7 @@
     command: tidy -xml -iq -m -w 0 /etc/firewalld/zones/public.xml
     notify:
       - restart firewalld
+      - restart fail2ban
 
   - name: Copy firewalld ipsets of abusive IPs
     when: ansible_distribution_major_version is version('10', '<=')
@@ -92,6 +97,7 @@
       - spamhaus-ipv6.xml
     notify:
       - restart firewalld
+      - restart fail2ban
 
   - name: Copy Spamhaus firewalld update script
     when: ansible_distribution_version is version('10', '<=')
@@ -134,6 +140,7 @@
     systemd: name=update-spamhaus-lists.timer state=started enabled=yes
     notify:
       - restart firewalld
+      - restart fail2ban
 
   - name: Start and enable nftables update timers
     when: ansible_distribution_version is version('11', '>=')

roles/common/tasks/firewall_Ubuntu.yml

@@ -35,6 +35,7 @@
     template: src=nftables.conf.j2 dest=/etc/nftables.conf owner=root mode=0644
     notify:
       - restart nftables
+      - restart fail2ban
 
   - name: Create /etc/nftables extra config directory
     when: ansible_distribution_version is version('20.04', '>=')
@@ -51,6 +52,7 @@
       - { src: "abuseipdb-ipv6.nft", force: "yes" }
     notify:
       - restart nftables
+      - restart fail2ban
 
   - name: Copy firewalld public zone file
     when: ansible_distribution_version is version('18.04', '<=')
@@ -61,6 +63,7 @@
     command: tidy -xml -iq -m -w 0 /etc/firewalld/zones/public.xml
     notify:
       - restart firewalld
+      - restart fail2ban
 
   - name: Copy firewalld ipsets of abusive IPs
     when: ansible_distribution_version is version('18.04', '<=')
@@ -72,6 +75,7 @@
       - spamhaus-ipv6.xml
     notify:
       - restart firewalld
+      - restart fail2ban
 
   - name: Copy Spamhaus firewalld update script
     when: ansible_distribution_version is version('18.04', '<=')
@@ -114,6 +118,7 @@
     systemd: name=update-spamhaus-lists.timer state=started enabled=yes
     notify:
       - restart firewalld
+      - restart fail2ban
 
   - name: Start and enable nftables update timers
     when: ansible_distribution_version is version('20.04', '>=')