diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..5c199eb
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,3 @@
+# ---> Ansible
+*.retry
+
diff --git a/defaults/main.yml b/defaults/main.yml
new file mode 100644
index 0000000..545f62a
--- /dev/null
+++ b/defaults/main.yml
@@ -0,0 +1,24 @@
+common_development: false
+
+# common_fail2ban.conf
+
+common_fail2ban_loglevel: INFO
+common_fail2ban_logtarget: /var/log/common_fail2ban.log
+common_fail2ban_syslog_socket: auto
+common_fail2ban_dbpurgeage: 1d
+common_fail2ban_dbmaxmatches: 10
+
+# jail.conf
+
+common_fail2ban_ignoreself: "true"
+common_fail2ban_ignoreips:
+  - 127.0.0.1/8
+  - ::1
+
+common_fail2ban_findtime: 600
+common_fail2ban_maxretry: 5
+common_fail2ban_bantime: 600
+common_fail2ban_protocol: "tcp"
+
+common_fail2ban_jails: 
+  - ssh.conf
diff --git a/handlers/main.yml b/handlers/main.yml
new file mode 100644
index 0000000..294fc6b
--- /dev/null
+++ b/handlers/main.yml
@@ -0,0 +1,12 @@
+#
+# handlers: main
+#
+#
+# @author Björn Hase <herrhase@node001.net>
+#
+
+- name: restart fail2ban
+  service:
+    name: fail2ban
+    enabled: yes
+    state: restarted
diff --git a/playbooks/common-configure.yml b/playbooks/common-configure.yml
new file mode 100644
index 0000000..8f791e5
--- /dev/null
+++ b/playbooks/common-configure.yml
@@ -0,0 +1,17 @@
+#
+# playbook: configure
+#
+#
+# @author Björn Hase <herrhase@node001.net>
+#
+
+- name: Install
+  hosts: all 
+  become: yes
+  roles:
+    - common
+
+  tasks:   
+    - include_role:
+        name: common
+        tasks_from: configure-fail2ban.yml
diff --git a/playbooks/common-install.yml b/playbooks/common-install.yml
new file mode 100644
index 0000000..2baf770
--- /dev/null
+++ b/playbooks/common-install.yml
@@ -0,0 +1,21 @@
+#
+# playbook: install basic stuff
+#
+#
+# @author Björn Hase <herrhase@node001.net>
+#
+
+- name: Install
+  hosts: all 
+  become: yes
+  roles:
+    - common
+
+  tasks:
+    - include_role:
+        name: common
+        tasks_from: install.yml
+
+    - include_role:
+        name: common
+        tasks_from: deployer.yml
diff --git a/playbooks/common-update.yml b/playbooks/common-update.yml
new file mode 100644
index 0000000..f8ee3ae
--- /dev/null
+++ b/playbooks/common-update.yml
@@ -0,0 +1,18 @@
+#
+# playbook: update
+#
+#
+# @author Björn Hase <herrhase@node001.net>
+#
+
+- name: Update Server
+  hosts: all
+  become: yes
+
+  roles:
+    - common
+
+  tasks:
+    - include_role:
+        name: common
+        tasks_from: update.yml
diff --git a/resources/fail2ban/filters/common-botssearch.conf b/resources/fail2ban/filters/common-botssearch.conf
new file mode 100644
index 0000000..f1a32ca
--- /dev/null
+++ b/resources/fail2ban/filters/common-botssearch.conf
@@ -0,0 +1,21 @@
+# Generic configuration file for -botsearch filters
+#
+# @source https://scalastic.io/en/ufw-fail2ban-nginx/#step-4-configuring-fail2bans-basic-rules
+# 
+
+[Init]
+
+# Block is the actual non-found directories to block
+block = \/?(<webmail>|<phpmyadmin>|<wordpress>|cgi-bin|mysqladmin)[^,]*
+
+# These are just convenient definitions that assist the blocking of stuff that 
+# isn't installed
+
+webmail = roundcube|(ext)?mail|horde|(v-?)?webmail
+phpmyadmin = (typo3/|xampp/|admin/|)(pma|(php)?[Mm]y[Aa]dmin)
+wordpress = wp-(login|signup|admin)\.php
+
+# DEV Notes:
+# Taken from apache-botsearch filter
+# 
+# Author: Frantisek Sumsal
diff --git a/resources/fail2ban/filters/nginx-4xx.conf b/resources/fail2ban/filters/nginx-4xx.conf
new file mode 100644
index 0000000..0076f66
--- /dev/null
+++ b/resources/fail2ban/filters/nginx-4xx.conf
@@ -0,0 +1,9 @@
+# block 
+# 
+# @source https://scalastic.io/en/ufw-fail2ban-nginx/#step-4-configuring-fail2bans-basic-rules
+# 
+
+[Definition]
+
+failregex = ^<HOST>.*"(GET|PUT|POST).*" (403) .*$
+ignoreregex = .*(robots.txt|favicon.ico|css|htc|js|asf|asx|wax|wmv|wmx|avi|bmp|class|divx|doc|docx|eot|exe|gif|gz|gzip|ico|jpg|jpeg|jpe|json|mdb|mid|midi|mov|qt|mp3|m4a|mp4|m4v|mpeg|mpg|mpe|mpp|otf|odb|odc|odf|odg|odp|ods|odt|ogg|pdf|png|pot|pps|ppt|pptx|ra|ram|svg|svgz|swf|tar|tif|tiff|ttf|ttc|wav|wma|wri|xla|xls|xlsx|xlt|xlw|zip)
diff --git a/resources/fail2ban/filters/nginx-botssearch.conf b/resources/fail2ban/filters/nginx-botssearch.conf
new file mode 100644
index 0000000..d49419f
--- /dev/null
+++ b/resources/fail2ban/filters/nginx-botssearch.conf
@@ -0,0 +1,20 @@
+# Fail2Ban filter to match web requests for selected URLs that don't exist
+# Based on apache-botsearch filter
+# 
+# Author: Frantisek Sumsal
+#
+# @source https://scalastic.io/en/ufw-fail2ban-nginx/#step-4-configuring-fail2bans-basic-rules
+
+[INCLUDES]
+
+# Load regexes for filtering
+before = botsearch-common.conf
+
+[Definition]
+
+failregex = ^<HOST> \- \S+ \[\] \"(GET|POST|HEAD) \/<block> \S+\" 404 .+$
+^ \[error\] \d+#\d+: \*\d+ (\S+ )?\"\S+\" (failed|is not found) \(2\: No such file or directory\), client\: <HOST>\, server\: \S*\, request: \"(GET|POST|HEAD) \/<block> \S+\"\, .*?$
+ignoreregex =
+datepattern = {^LN-BEG}%%ExY(?P<_sep>[-/.])%%m(?P=_sep)%%d[T ]%%H:%%M:%%S(?:[.,]%%f)?(?:\s*%%z)?
+^[^\[]*\[({DATE})
+{^LN-BEG}
diff --git a/resources/fail2ban/filters/nginx-error-common.conf b/resources/fail2ban/filters/nginx-error-common.conf
new file mode 100644
index 0000000..2fe4e3f
--- /dev/null
+++ b/resources/fail2ban/filters/nginx-error-common.conf
@@ -0,0 +1,31 @@
+# Generic nginx error_log configuration items (to be used as interpolations) in other
+# filters monitoring nginx error-logs
+#
+# @source https://scalastic.io/en/ufw-fail2ban-nginx/#step-4-configuring-fail2bans-basic-rules
+
+[DEFAULT]
+
+# Type of log-file resp. log-format (file, short, journal):
+logtype = file
+
+# Daemon definition is to be specialized (if needed) in .conf file
+_daemon = nginx
+
+# Common line prefixes (beginnings) which could be used in filters
+#
+# [bsdverbose]? [hostname] [vserver tag] daemon_id spaces
+#
+# This can be optional (for instance if we match named native log files)
+
+__prefix = <lt_<logtype>/__prefix>
+__err_type = error
+__prefix_line = %(__prefix)s\[%(__err_type)s\] \d+#\d+: \*\d+\s+
+
+[lt_file]
+__prefix = \s*
+
+[lt_short]
+__prefix = \s*(?:(?!\[)\S+ %(_daemon)s\[\d+\]: [^\[]*)?
+
+[lt_journal]
+__prefix = %(lt_short/__prefix)s
diff --git a/resources/fail2ban/filters/nginx-forbidden.conf b/resources/fail2ban/filters/nginx-forbidden.conf
new file mode 100644
index 0000000..3943a06
--- /dev/null
+++ b/resources/fail2ban/filters/nginx-forbidden.conf
@@ -0,0 +1,9 @@
+# targets attempts to access forbidden directories
+# 
+# @source https://scalastic.io/en/ufw-fail2ban-nginx/#step-4-configuring-fail2bans-basic-rules
+# 
+
+[Definition]
+
+failregex = directory index of .+ is forbidden, client: <HOST>, server: .+
+ignoreregex =
diff --git a/resources/fail2ban/filters/nginx-http-auth.conf b/resources/fail2ban/filters/nginx-http-auth.conf
new file mode 100644
index 0000000..4f00c75
--- /dev/null
+++ b/resources/fail2ban/filters/nginx-http-auth.conf
@@ -0,0 +1,44 @@
+# Blocking auth
+#
+# @source https://github.com/fail2ban/fail2ban/blob/master/config/filter.d/nginx-http-auth.conf
+# 
+
+# fail2ban filter configuration for nginx
+
+[INCLUDES]
+
+before = nginx-error-common.conf
+
+[Definition]
+
+mode = normal
+
+__err_type = <_ertp-<mode>>
+
+_ertp-auth = error
+mdre-auth = ^%(__prefix_line)suser "(?:[^"]+|.*?)":? (?:password mismatch|was not found in "[^\"]*"), client: <HOST>, server: \S*, request: "\S+ \S+ HTTP/\d+\.\d+", host: "\S+"(?:, referrer: "\S+")?\s*$
+_ertp-fallback = crit
+mdre-fallback = ^%(__prefix_line)sSSL_do_handshake\(\) failed \(SSL: error:\S+(?: \S+){1,3} too (?:long|short)\)[^,]*, client: <HOST>
+
+_ertp-normal = %(_ertp-auth)s
+mdre-normal = %(mdre-auth)s
+_ertp-aggressive = (?:%(_ertp-auth)s|%(_ertp-fallback)s)
+mdre-aggressive = %(mdre-auth)s
+                  %(mdre-fallback)s
+
+failregex = <mdre-<mode>>
+ignoreregex = 
+datepattern = {^LN-BEG}
+journalmatch = _SYSTEMD_UNIT=nginx.service + _COMM=nginx
+
+# DEV NOTES:
+# mdre-auth:
+# Based on samples in https://github.com/fail2ban/fail2ban/pull/43/files
+# Extensive search of all nginx auth failures not done yet.
+# 
+# Author: Daniel Black
+
+# mdre-fallback:
+# Ban people checking for TLS_FALLBACK_SCSV repeatedly
+# https://stackoverflow.com/questions/28010492/nginx-critical-error-with-ssl-handshaking/28010608#28010608
+# Author: Stephan Orlowsky
diff --git a/resources/fail2ban/filters/nginx-limit-req.conf b/resources/fail2ban/filters/nginx-limit-req.conf
new file mode 100644
index 0000000..e23548a
--- /dev/null
+++ b/resources/fail2ban/filters/nginx-limit-req.conf
@@ -0,0 +1,46 @@
+# Fail2ban filter configuration for nginx :: limit_req
+# used to ban hosts, that were failed through nginx by limit request processing rate 
+#
+# Author: Serg G. Brester (sebres)
+#
+# To use 'nginx-limit-req' filter you should have `ngx_http_limit_req_module`
+# and define `limit_req` and `limit_req_zone` as described in nginx documentation
+# http://nginx.org/en/docs/http/ngx_http_limit_req_module.html
+#
+# Example:
+#
+#   http {
+#     ...
+#     limit_req_zone $binary_remote_addr zone=lr_zone:10m rate=1r/s;
+#     ...
+#     # http, server, or location:
+#     location ... {
+#       limit_req zone=lr_zone burst=1 nodelay;
+#       ...
+#     }
+#     ...
+#   }
+#   ...
+#
+
+[Definition]
+
+# Specify following expression to define exact zones, if you want to ban IPs limited 
+# from specified zones only.
+# Example:
+#
+#   ngx_limit_req_zones = lr_zone|lr_zone2
+#
+ngx_limit_req_zones = [^"]+
+
+# Use following full expression if you should range limit request to specified 
+# servers, requests, referrers etc. only :
+#
+# failregex = ^\s*\[[a-z]+\] \d+#\d+: \*\d+ limiting requests, excess: [\d\.]+ by zone "(?:%(ngx_limit_req_zones)s)", client: <HOST>, server: \S*, request: "\S+ \S+ HTTP/\d+\.\d+", host: "\S+"(, referrer: "\S+")?\s*$
+
+# Shortly, much faster and stable version of regexp:
+failregex = ^\s*\[[a-z]+\] \d+#\d+: \*\d+ limiting requests, excess: [\d\.]+ by zone "(?:%(ngx_limit_req_zones)s)", client: <HOST>,
+
+ignoreregex = 
+
+datepattern = {^LN-BEG}
diff --git a/resources/fail2ban/filters/nginx-noscript.conf b/resources/fail2ban/filters/nginx-noscript.conf
new file mode 100644
index 0000000..a7499b2
--- /dev/null
+++ b/resources/fail2ban/filters/nginx-noscript.conf
@@ -0,0 +1,19 @@
+# 
+# nginx-noscript
+# 
+# 
+
+[INCLUDES]
+
+# overwrite with apache-common.local if _apache_error_client is incorrect.
+before = apache-common.conf
+
+[Definition]
+
+script = /\S*(?:php(?:[45]|[.-]cgi)?|\.asp|\.exe|\.pl|\bcgi-bin/)
+
+prefregex = ^%(_apache_error_client)s (?:AH0(?:01(?:28|30)|1(?:264|071)|2811): )?(?:(?:[Ff]ile|script|[Gg]ot) )<F-CONTENT>.+</F-CONTENT>$
+
+failregex = ^(?:does not exist|not found or unable to stat): <script>\b
+            ^'<script>\S*' not found or unable to stat
+            \[error\].+"[Pp]rimary script unknown"(?:\\n)?
diff --git a/resources/fail2ban/filters/nginx-sslerror.conf b/resources/fail2ban/filters/nginx-sslerror.conf
new file mode 100644
index 0000000..a4aa9fa
--- /dev/null
+++ b/resources/fail2ban/filters/nginx-sslerror.conf
@@ -0,0 +1,11 @@
+# protects against SSL handshake failure attacks
+#
+#
+
+[Definition]
+
+failregex = SSL_do_handshake\(\) failed .+ while SSL handshaking, client: <HOST>, server: .+
+ignoreregex =
+datepattern = {^LN-BEG}%%ExY(?P<_sep>[-/.])%%m(?P=_sep)%%d[T ]%%H:%%M:%%S(?:[.,]%%f)?(?:\s*%%z)?
+^[^\[]*\[({DATE})
+{^LN-BEG}
diff --git a/resources/fail2ban/filters/wordpress-auth.conf b/resources/fail2ban/filters/wordpress-auth.conf
new file mode 100644
index 0000000..a7ee097
--- /dev/null
+++ b/resources/fail2ban/filters/wordpress-auth.conf
@@ -0,0 +1,8 @@
+# wordpress login failed
+
+[INCLUDES]
+before = common.conf
+
+[Definition]
+failregex = <HOST>.*POST.*(wp-login\.php|xmlrpc\.php).* 200
+ignoreregex =  
diff --git a/resources/fail2ban/filters/wordpress-cron.conf b/resources/fail2ban/filters/wordpress-cron.conf
new file mode 100644
index 0000000..ba8cce9
--- /dev/null
+++ b/resources/fail2ban/filters/wordpress-cron.conf
@@ -0,0 +1,4 @@
+# wordpress cron 
+
+[Definition]
+failregex = ^<HOST> .*POST .*wp-cron\.php.*
diff --git a/resources/fail2ban/filters/wordpress-xmlrpc.conf b/resources/fail2ban/filters/wordpress-xmlrpc.conf
new file mode 100644
index 0000000..edde938
--- /dev/null
+++ b/resources/fail2ban/filters/wordpress-xmlrpc.conf
@@ -0,0 +1,8 @@
+# wordpress xmlrpc
+
+[INCLUDES]
+before = common.conf
+
+[Definition]
+failregex = <HOST>.*(xmlrpc\.php).* 403
+ignoreregex =  
diff --git a/resources/fail2ban/jail/mysql-auth.conf b/resources/fail2ban/jail/mysql-auth.conf
new file mode 100644
index 0000000..873f129
--- /dev/null
+++ b/resources/fail2ban/jail/mysql-auth.conf
@@ -0,0 +1,8 @@
+[mysqld-auth]
+enabled   = true
+port      = 3306
+filter    = mysqld-auth
+logpath   = /var/log/mysql/error.log
+findtime  = 3600
+maxretry  = 5
+bantime   = 86400
diff --git a/resources/fail2ban/jail/nginx-badbots.conf b/resources/fail2ban/jail/nginx-badbots.conf
new file mode 100644
index 0000000..07f5d11
--- /dev/null
+++ b/resources/fail2ban/jail/nginx-badbots.conf
@@ -0,0 +1,9 @@
+# stop some known malicious bot request patterns
+
+[nginx-badbots]
+
+enabled  = true
+port     = http,https
+filter   = apache-badbots
+logpath  = /var/log/nginx/*access.log
+maxretry = 2
\ No newline at end of file
diff --git a/resources/fail2ban/jail/nginx-botsearch.conf b/resources/fail2ban/jail/nginx-botsearch.conf
new file mode 100644
index 0000000..c3b73a0
--- /dev/null
+++ b/resources/fail2ban/jail/nginx-botsearch.conf
@@ -0,0 +1,7 @@
+[nginx-botsearch]
+
+enabled  = true
+port     = http,https
+filter   = nginx-botsearch
+logpath  = /var/log/nginx/*access.log
+maxretry = 2
\ No newline at end of file
diff --git a/resources/fail2ban/jail/nginx-http-auth.conf b/resources/fail2ban/jail/nginx-http-auth.conf
new file mode 100644
index 0000000..da27e33
--- /dev/null
+++ b/resources/fail2ban/jail/nginx-http-auth.conf
@@ -0,0 +1,9 @@
+# ban clients that are searching for scripts on the website to execute and exploit,
+# only using if php not in use
+
+[nginx-http-auth]
+
+enabled  = true
+filter   = nginx-http-auth
+port     = http,https
+logpath  = /var/log/nginx/*error.log
\ No newline at end of file
diff --git a/resources/fail2ban/jail/nginx-limit-req.conf b/resources/fail2ban/jail/nginx-limit-req.conf
new file mode 100644
index 0000000..839e031
--- /dev/null
+++ b/resources/fail2ban/jail/nginx-limit-req.conf
@@ -0,0 +1,10 @@
+# dos 
+
+[nginx-req-limit]
+
+enabled  = true
+filter   = nginx-limit-req
+logpath  = /var/log/nginx/*error.log
+findtime = 600
+bantime  = 7200
+maxretry = 10
diff --git a/resources/fail2ban/jail/nginx-nohome.conf b/resources/fail2ban/jail/nginx-nohome.conf
new file mode 100644
index 0000000..b0e74cb
--- /dev/null
+++ b/resources/fail2ban/jail/nginx-nohome.conf
@@ -0,0 +1,7 @@
+[nginx-nohome]
+
+enabled  = true
+port     = http,https
+filter   = apache-nohome
+logpath  = /var/log/nginx/*access.log
+maxretry = 2
\ No newline at end of file
diff --git a/resources/fail2ban/jail/nginx-noscript.conf b/resources/fail2ban/jail/nginx-noscript.conf
new file mode 100644
index 0000000..4358e62
--- /dev/null
+++ b/resources/fail2ban/jail/nginx-noscript.conf
@@ -0,0 +1,7 @@
+[nginx-noscript]
+
+enabled  = true
+port     = http,https
+filter   = nginx-noscript
+logpath  = /var/log/nginx/*error.log
+maxretry = 2
diff --git a/resources/fail2ban/jail/ssh.conf b/resources/fail2ban/jail/ssh.conf
new file mode 100644
index 0000000..787a2eb
--- /dev/null
+++ b/resources/fail2ban/jail/ssh.conf
@@ -0,0 +1,5 @@
+[ssh]
+enabled  = true
+port     = ssh
+filter   = sshd
+logpath  = /var/log/auth.log
diff --git a/resources/fail2ban/jail/wordpress-auth.conf b/resources/fail2ban/jail/wordpress-auth.conf
new file mode 100644
index 0000000..4ee00ab
--- /dev/null
+++ b/resources/fail2ban/jail/wordpress-auth.conf
@@ -0,0 +1,7 @@
+[wordpress-auth]
+enabled = true
+filter = wordpress-auth
+logpath = /var/log/nginx/*access.log
+maxretry = 5
+bantime = 1 day
+datepattern = %%d/%%b/%%Y:%%H:%%M:%%S \+%%f
diff --git a/resources/fail2ban/jail/wordpress-cron.conf b/resources/fail2ban/jail/wordpress-cron.conf
new file mode 100644
index 0000000..32bde08
--- /dev/null
+++ b/resources/fail2ban/jail/wordpress-cron.conf
@@ -0,0 +1,7 @@
+[wordpress-cron]
+enabled = true
+filter = wordpress-cron
+logpath = /var/log/nginx/*access.log
+maxretry = 5
+bantime = 1 day
+datepattern = %%d/%%b/%%Y:%%H:%%M:%%S \+%%f
diff --git a/resources/fail2ban/jail/wordpress-xmlrpc.conf b/resources/fail2ban/jail/wordpress-xmlrpc.conf
new file mode 100644
index 0000000..a833ff5
--- /dev/null
+++ b/resources/fail2ban/jail/wordpress-xmlrpc.conf
@@ -0,0 +1,7 @@
+[wordpress-xmlrpc]
+enabled = true
+filter = wordpress-xmlrpc
+logpath = /var/log/nginx/*access.log
+maxretry = 1
+bantime = 1 day
+datepattern = %%d/%%b/%%Y:%%H:%%M:%%S \+%%f
diff --git a/tasks/configure-fail2ban.yml b/tasks/configure-fail2ban.yml
new file mode 100644
index 0000000..3ab4c62
--- /dev/null
+++ b/tasks/configure-fail2ban.yml
@@ -0,0 +1,48 @@
+# 
+# task: configure fail2ban
+#
+# @author Björn Hase <herrhase@node001.net>
+#
+
+- name: adding configuration fail2ban/fail2ban.local
+  template:
+    src: fail2ban/fail2ban.local
+    dest: /etc/fail2ban/fail2ban.local
+    owner: root
+    group: root
+    mode: '0644'
+
+- name: adding configuration fail2ban/jail.local
+  template:
+    src: fail2ban/jail.local
+    dest: /etc/fail2ban/jail.local
+    owner: root
+    group: root
+    mode: '0644'
+
+- name: copy filters
+  copy:
+    src: ../resources/fail2ban/filters/
+    dest: /etc/fail2ban/filter.d/
+    owner: root
+    group: root
+    mode: '0644'
+
+- name: find & delete old jails files
+  find: 
+    paths: /etc/fail2ban/jail.d
+  register: fail2ban_outdated_files
+
+- file:
+    state: absent
+    path: "{{ item.path }}"
+  loop: "{{ fail2ban_outdated_files.files }}"
+  when: fail2ban_outdated_files.files is defined
+
+- name: enable jails
+  copy: 
+    src: ../ressources/fail2ban/jail/{{ item }}
+    dest: /etc/fail2ban/jail.d/{{ item }}
+  with_items: "{{ common_fail2ban_jails }}"
+
+- notify: restart fail2ban
diff --git a/tasks/configure-ufw.yml b/tasks/configure-ufw.yml
new file mode 100644
index 0000000..56dc103
--- /dev/null
+++ b/tasks/configure-ufw.yml
@@ -0,0 +1,18 @@
+# 
+# fail2ban
+# adding ssh jail
+#
+
+#  
+# ufw 
+# only allows ssh
+#
+
+- name: Configure ufw 
+  ufw:
+    rule: allow
+    name: OpenSSH
+
+- name: Enable ufw 
+  ufw:
+    state: enabled
diff --git a/tasks/deployer.yml b/tasks/deployer.yml
new file mode 100644
index 0000000..d4345e9
--- /dev/null
+++ b/tasks/deployer.yml
@@ -0,0 +1,42 @@
+#
+# task: create deployer 
+#
+#
+# @author Björn Hase <herrhase@node001.net>
+#
+
+
+- name: Check if users exist
+  getent:
+    database: passwd
+    key: deploy
+    fail_key: false
+
+- name: create password
+  set_fact:
+    password="{{ lookup('ansible.builtin.password', '~/deploy.txt', length=30, chars=['ascii_letters', 'digits']) }}"
+
+#
+# create user if not exists
+#
+- name: create user 
+  user:
+    name: deploy
+    password: "{{ password }}"
+    create_home: yes
+  when: ansible_facts.getent_passwd|bool == false
+
+#
+# create ssh-key add to authorized_keys as deploy user
+#
+- stat:
+    path: ~/.ssh/git
+  become_user: deploy
+  register: git_key
+
+- name: create ssh
+  shell: |
+    ssh-keygen -t ed25519 -f ~/.ssh/git -C $(hostname) -q -P ""
+    cat ~/.ssh/git.pub >> ~/.ssh/authorized_keys
+  become_user: deploy
+  when: ansible_facts.getent_passwd|bool == false and not git_key.stat.exists
diff --git a/tasks/install.yml b/tasks/install.yml
new file mode 100644
index 0000000..571bc63
--- /dev/null
+++ b/tasks/install.yml
@@ -0,0 +1,30 @@
+#
+# task: install 
+#
+
+- name: Remove ubuntu tools
+  apt: 
+    name: ubuntu-advantage-tools 
+    state: absent
+
+# 
+# install software packages  
+#
+
+- name: Install unzip, curl, software-properties-common, git & ca-certificates gnupg
+  apt: 
+    name: 
+      - unzip 
+      - curl 
+      - software-properties-common 
+      - ca-certificates
+      - gnupg
+      - git
+      - ufw
+      - fail2ban
+      - sshpass
+      - python3 
+      - python3-pip 
+      - python3-passlib
+    update_cache: yes
+    cache_valid_time: 3600
diff --git a/tasks/update.yml b/tasks/update.yml
new file mode 100644
index 0000000..35d18b1
--- /dev/null
+++ b/tasks/update.yml
@@ -0,0 +1,29 @@
+#
+# task: update 
+#
+
+- name: Updates with APT
+  apt:
+    name: '*'
+    state: latest
+    update_cache: yes
+    only_upgrade: yes
+
+#
+# check for reboot
+#
+
+- name: Check if a reboot is needed for Debian and Ubuntu boxes
+  register: reboot_required_file
+  stat: 
+    path: /var/run/reboot-required
+
+- name: Reboot the Debian or Ubuntu server
+  reboot:
+    msg: "Reboot initiated by Ansible due to kernel updates"
+    connect_timeout: 5
+    reboot_timeout: 300
+    pre_reboot_delay: 0
+    post_reboot_delay: 30
+    test_command: uptime
+  when: reboot_required_file.stat.exists
diff --git a/templates/fail2ban/fail2ban.local b/templates/fail2ban/fail2ban.local
new file mode 100644
index 0000000..8506e16
--- /dev/null
+++ b/templates/fail2ban/fail2ban.local
@@ -0,0 +1,17 @@
+{{ ansible_managed | comment }}
+
+# Overrides values from the fail2ban.conf configuration file.
+# For comments relating to each setting see fail2ban.conf
+
+[default]
+
+loglevel = {{ common_fail2ban_loglevel }}
+logtarget = {{ common_fail2ban_logtarget }}
+syslogsocket = {{ common_fail2ban_syslog_socket }}
+
+socket = /var/run/fail2ban/fail2ban.sock
+pidfile = /var/run/fail2ban/fail2ban.pid
+dbfile = /var/lib/fail2ban/fail2ban.sqlite3
+
+dbpurgeage = {{ common_fail2ban_dbpurgeage }}
+dbmaxmatches = {{ common_fail2ban_dbmaxmatches }}
diff --git a/templates/fail2ban/jail.local b/templates/fail2ban/jail.local
new file mode 100644
index 0000000..93b2ebe
--- /dev/null
+++ b/templates/fail2ban/jail.local
@@ -0,0 +1,56 @@
+{{ ansible_managed | comment }}
+
+[includes]
+
+before = paths-debian.conf
+
+[default]
+
+# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
+# ban a host which matches an address in this list. Several addresses can be
+# defined using space separator.
+ignoreip = {{ common_fail2ban_ignoreips | join(' ') }}
+ignoreself = {{ common_fail2ban_ignoreself }}
+
+# The length of time between login attempts before a ban is set.
+# For example, if Fail2ban is set to ban an IP after five (3) failed log-in attempts,
+# those 3 attempts must occur within the set 10-minute findtime limit.
+# The findtime value should be a set number of seconds.
+findtime = {{ common_fail2ban_findtime }}
+
+# max retries, before ban
+maxretry = {{ common_fail2ban_maxretry }}
+
+# reverse-Lookup-behavior
+usedns = warn
+
+# mail
+destemail = root@localhost
+sendername = Fail2Ban
+mta = sendmail
+
+#
+chain = INPUT
+
+#
+# Actions
+#
+
+action_ = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
+action_mw = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
+            %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s", sendername="%(sendername)s"]
+action_mwl = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
+            %(mta)s-whois-lines[name=%(__name__)s, dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s", sendername="%(sendername)s"]
+action = %(action_)s
+
+# "bantime" is the number of seconds that a host is banned.
+bantime = {{ common_fail2ban_bantime }}
+
+# "banaction"
+banaction = ufw
+
+# backend 
+backend = auto
+
+# tcp, udp, icmp, all
+protocol = {{ common_fail2ban_protocol }}