Role ipt-server: restart fail2ban after a firewall restart if it is running.

A firewall restart flushes the fail2ban chains. The new handler restarts
fail2ban only if it is active; it does nothing if fail2ban is stopped or
not installed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/ipt-server/handlers/main.yml

@@ -8,8 +8,22 @@
   service:
     name: ipt-firewall
     state: restarted
+  notify: Restart fail2ban if active
 
 - name: Restart IPv6 Firewall
   service:
     name: ip6t-firewall
     state: restarted
+  notify: Restart fail2ban if active
+
+# A firewall restart flushes the fail2ban chains; restarting fail2ban
+# recreates them and re-applies the active bans. Does nothing if fail2ban
+# is not installed or not running.
+- name: Restart fail2ban if active
+  shell: |
+    if systemctl is-active --quiet fail2ban ; then
+       systemctl restart fail2ban
+       echo restarted
+    fi
+  register: fail2ban_restart
+  changed_when: "'restarted' in fail2ban_restart.stdout"