---

- name: Reload systemd daemon
  systemd:
    daemon_reload: true

- name: Restart IPv4 Firewall
  service:
    name: ipt-firewall
    state: restarted
  notify: Restart fail2ban if active

- name: Restart IPv6 Firewall
  service:
    name: ip6t-firewall
    state: restarted
  notify: Restart fail2ban if active

# A firewall restart flushes the fail2ban chains; restarting fail2ban
# recreates them and re-applies the active bans. Does nothing if fail2ban
# is not installed or not running.
- name: Restart fail2ban if active
  shell: |
    if systemctl is-active --quiet fail2ban ; then
       systemctl restart fail2ban
       echo restarted
    fi
  register: fail2ban_restart
  changed_when: "'restarted' in fail2ban_restart.stdout"