switched to roles

- all tasks/* have been moved to their own roles in roles/*
- each file && template is now oragnized per-role
- annotated each task which still isn't idempotent !TODO!

roles/firewall/files/jails.local

@@ -0,0 +1,8 @@
+[sshd]
+enabled = true
+
+[nginx-http-auth]
+enabled = true
+
+[nginx-botsearch]
+enabled = true

roles/firewall/tasks/main.yml

@@ -0,0 +1,33 @@
+---
+- name: Allow port 22
+  community.general.ufw:
+    rule: allow
+    port: '22'
+    proto: tcp
+
+- name: Allow port 80
+  community.general.ufw:
+    rule: allow
+    port: '80'
+    proto: tcp
+
+- name: Allow port 443
+  community.general.ufw:
+    rule: allow
+    port: '443'
+    proto: tcp
+
+- name: Startup UFW
+  community.general.ufw:
+    state: enabled
+
+- name: Copy fail2ban jail config
+  copy:
+    src: jails.local
+    dest: /etc/fail2ban/jail.d/jails.local
+
+- name: Enable fail2ban service
+  systemd:
+    name: fail2ban
+    enabled: yes
+    state: started