second commit

ansible/roles/fail2ban/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: restart fail2ban
+  ansible.builtin.service:
+    name: fail2ban
+    state: restarted

ansible/roles/fail2ban/tasks/main.yml

@@ -0,0 +1,38 @@
+---
+# Zweite Verteidigungslinie gegen Brute-Force zusaetzlich zum
+# Anwendungs-Rate-Limiting (Konzept 6.2). Ueberwacht die Uvicorn-/nginx-
+# Access-Logs auf gehaeufte 401-Antworten vom Login-Endpunkt.
+
+- name: fail2ban installieren
+  ansible.builtin.apt:
+    name: fail2ban
+    state: present
+    update_cache: true
+
+- name: Filter fuer Jumphost-Login-Fehlversuche
+  ansible.builtin.copy:
+    dest: /etc/fail2ban/filter.d/jumphost-login.conf
+    owner: root
+    group: root
+    mode: "0644"
+    content: |
+      [Definition]
+      failregex = ^.*"POST /auth/login(/totp)? HTTP/.*" 401 .*client_ip=<HOST>.*$
+                  ^.*"POST /auth/login(/totp)? HTTP/.*" 401 .*<HOST>.*$
+      ignoreregex =
+
+- name: Jail fuer Jumphost-Login aktivieren
+  ansible.builtin.copy:
+    dest: /etc/fail2ban/jail.d/jumphost.conf
+    owner: root
+    group: root
+    mode: "0644"
+    content: |
+      [jumphost-login]
+      enabled  = true
+      filter   = jumphost-login
+      logpath  = /var/log/jumphost/access.log
+      maxretry = 8
+      findtime = 300
+      bantime  = 1800
+  notify: restart fail2ban