Make Fail2ban settings extensible

[raph-topo]

add the ability to add custom services in group_vars/;
add the ability to include custom filters in a new fail2ban-filters/ folder;
inspired from the nginx-includes task in wordpress-setup role.

• custom services
• custom filters
• readme
• changelog
• docs

[raph-topo]

A use case would be adding services and filters to integrate the WP-Fail2ban plugin.

[swalkinshaw]

Thanks for the suggestion and use case. By default, every variable in Ansible can be overridden in group_vars as it takes precedence. So right now, without this PR, you could do the following:

# group_vars/all/fail2ban.yml

fail2ban_services:
  - name: ssh
    port: ssh
    filter: sshd
    logpath: /var/log/auth.log
  - name: postfix
    port: smtp,ssmtp
    filter: postfix
    logpath: /var/log/mail.log

The README in the role points this out: https://github.com/roots/trellis/blob/5de70af75e24d0c00826f079532099728361179a/roles/fail2ban/README.md#example-playbook

The one very minor downside here is you need to include the default ssh entry. If you don't it will be removed.

Nginx includes warrant their own extra solution for one main reason: they are templates which can't just be represented in a YAML data structure like these fail2ban services can.

This seems like it would solve your use case; can you confirm that? If so, I'd prefer just using these default features of Ansible in this case instead of adding an extra feature.

[raph-topo]

The one very minor downside here is you need to include the default ssh entry. If you don't it will be removed.

Indeed, and people might miss or forget that and inadvertently deactivate the ssh filter. So I believe it is safer to make it extensible by default instead of just replaceable.
Also, having a _default and a _custom allows Trellis to add services through without conflicts.

This seems like it would solve your use case; can you confirm that?

For the services part yes, for the filters part no. They still have to be copied over to the servers, which I introduce in the second commit d7f8733

For the WP Fail2ban, 3 filters and 3 services have to be added.

If this convinces you, should I also edit the Fail2ban Readme and add this to the docs in Digging deeper or Security?

[raph-topo]

By the forums, it seems people bumped into this already without being able to configure Fail2ban as expected.

[swalkinshaw]

Ah thank you, that makes sense! I didn't know about the filters.

Yes updating the README + docs would be great. Thank you 😄

[raph-topo]

This PR should be ready, but I am still working on roots/docs. But I am blocked by an unexpected behavior described in #1181.

[raph-topo]

Rebased to HEAD.
OK for merge of this PR.

[swalkinshaw]

🎉 thank you this is great. Tested it out and works as expected.