- name: Install fail2ban
  become: true
  apt:
    cache_valid_time: 3600
    install_recommends: no
    name: fail2ban
    state: latest
    update_cache: yes
  register: fail2ban

- name: Configure Debian firewall
  become: true
  copy:
    src: etc
    dest: /
    owner: root
    group: root
    directory_mode: '0750'
    mode: '0750'
    force: no
  register: etc

- name: Fix permissions for /etc/network/functions
  become: true
  file:
    path: /etc/network/functions.phd
    mode: '0640'
  register: functions

- name: Start Debian firewall
  become: true
  service:
    name: iptables.sh
    state: restarted
  when: fail2ban.changed or etc.changed or functions.changed