{{ ansible_managed | comment }}

[includes]

before = paths-debian.conf

[default]

# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = {{ common_fail2ban_ignoreips | join(' ') }}
ignoreself = {{ common_fail2ban_ignoreself }}

# The length of time between login attempts before a ban is set.
# For example, if Fail2ban is set to ban an IP after five (3) failed log-in attempts,
# those 3 attempts must occur within the set 10-minute findtime limit.
# The findtime value should be a set number of seconds.
findtime = {{ common_fail2ban_findtime }}

# max retries, before ban
maxretry = {{ common_fail2ban_maxretry }}

# reverse-Lookup-behavior
usedns = warn

# mail
destemail = root@localhost
sendername = Fail2Ban
mta = sendmail

#
chain = INPUT

#
# Actions
#

action_ = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
action_mw = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
            %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s", sendername="%(sendername)s"]
action_mwl = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
            %(mta)s-whois-lines[name=%(__name__)s, dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s", sendername="%(sendername)s"]
action = %(action_)s

# "bantime" is the number of seconds that a host is banned.
bantime = {{ common_fail2ban_bantime }}

# "banaction"
banaction = ufw

# backend 
backend = auto

# tcp, udp, icmp, all
protocol = {{ common_fail2ban_protocol }}