From ec62f54ab4ceafc031636742f6982d5072bf97f3 Mon Sep 17 00:00:00 2001 From: Christoph Date: Tue, 3 Nov 2026 00:52:08 +0100 Subject: [PATCH] Role ipt-server: restart fail2ban after a firewall restart if it is running. A firewall restart flushes the fail2ban chains. The new handler restarts fail2ban only if it is active; it does nothing if fail2ban is stopped or not installed. Co-Authored-By: Claude Opus 5.5 --- roles/ipt-server/handlers/main.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/roles/ipt-server/handlers/main.yml b/roles/ipt-server/handlers/main.yml index 6395812..00eb1e6 100644 --- a/roles/ipt-server/handlers/main.yml +++ b/roles/ipt-server/handlers/main.yml @@ -8,8 +8,22 @@ service: name: ipt-firewall state: restarted + notify: Restart fail2ban if active - name: Restart IPv6 Firewall service: name: ip6t-firewall state: restarted + notify: Restart fail2ban if active + +# A firewall restart flushes the fail2ban chains; restarting fail2ban +# recreates them and re-applies the active bans. Does nothing if fail2ban +# is not installed or not running. +- name: Restart fail2ban if active + shell: | + if systemctl is-active --quiet fail2ban ; then + systemctl restart fail2ban + echo restarted + fi + register: fail2ban_restart + changed_when: "'restarted' in fail2ban_restart.stdout"