Ansible config for hetzner mailserver

ansible/mailserver/roles/fail2ban/defaults/main.yml

@@ -0,0 +1,18 @@
+---
+fail2ban_bantime: "1h"
+fail2ban_findtime: "10m"
+fail2ban_maxretry: 5
+
+fail2ban_jails:
+  - name: sshd
+    enabled: true
+    port: "{{ ssh_port | default(22) }}"
+    maxretry: 3
+    bantime: "1h"
+  - name: stalwart-auth
+    enabled: true
+    port: "25,465,587,993,443"
+    maxretry: 5
+    bantime: "1h"
+    logpath: "/opt/stalwart/logs/stalwart.log*"
+    filter: stalwart-auth

ansible/mailserver/roles/fail2ban/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: restart fail2ban
+  ansible.builtin.systemd:
+    name: fail2ban
+    state: restarted

ansible/mailserver/roles/fail2ban/tasks/main.yml

@@ -0,0 +1,25 @@
+---
+- name: Install fail2ban
+  ansible.builtin.apt:
+    name: fail2ban
+    state: present
+
+- name: Deploy Stalwart auth filter
+  ansible.builtin.template:
+    src: stalwart-auth.conf.j2
+    dest: /etc/fail2ban/filter.d/stalwart-auth.conf
+    mode: "0644"
+  notify: restart fail2ban
+
+- name: Deploy jail.local
+  ansible.builtin.template:
+    src: jail.local.j2
+    dest: /etc/fail2ban/jail.local
+    mode: "0644"
+  notify: restart fail2ban
+
+- name: Enable and start fail2ban
+  ansible.builtin.systemd:
+    name: fail2ban
+    enabled: true
+    state: started

ansible/mailserver/roles/fail2ban/templates/jail.local.j2

@@ -0,0 +1,20 @@
+[DEFAULT]
+bantime = {{ fail2ban_bantime }}
+findtime = {{ fail2ban_findtime }}
+maxretry = {{ fail2ban_maxretry }}
+banaction = ufw
+
+{% for jail in fail2ban_jails %}
+[{{ jail.name }}]
+enabled = {{ jail.enabled | lower }}
+port = {{ jail.port }}
+maxretry = {{ jail.maxretry | default(fail2ban_maxretry) }}
+bantime = {{ jail.bantime | default(fail2ban_bantime) }}
+{% if jail.logpath is defined %}
+logpath = {{ jail.logpath }}
+{% endif %}
+{% if jail.filter is defined %}
+filter = {{ jail.filter }}
+{% endif %}
+
+{% endfor %}

ansible/mailserver/roles/fail2ban/templates/stalwart-auth.conf.j2

@@ -0,0 +1,4 @@
+[Definition]
+failregex = ^\s*\S+ authentication\s+error\s+.*?remote\.ip=<HOST>
+            ^\s*.*?Authentication failed.*?ip=<HOST>
+ignoreregex =