Dockerfile

+FROM python:3.8-slim
+
+ENV S3CMD_VER=2.3.0
+ENV ANSIBLE_VER=4.10.0
+ENV OSC_VER=5.8.0
+ENV TF_VER=1.4.6
+ENV PACKER_VER=1.9.4
+
+RUN apt-get update && apt-get install --no-install-recommends -y \
+    git \
+    ssh \
+    curl \
+    wget \
+    unzip \
+ && rm -rf /var/lib/apt/lists/*
+RUN wget https://releases.hashicorp.com/packer/${PACKER_VER}/packer_${PACKER_VER}_linux_amd64.zip \
+    && unzip packer_${PACKER_VER}_linux_amd64.zip -d /usr/local/bin \
+    && rm packer_${PACKER_VER}_linux_amd64.zip
+RUN wget https://releases.hashicorp.com/terraform/${TF_VER}/terraform_${TF_VER}_linux_amd64.zip \
+    && unzip terraform_${TF_VER}_linux_amd64.zip -d /usr/local/bin \
+    && rm terraform_${TF_VER}_linux_amd64.zip
+RUN pip install --no-cache-dir --upgrade pip \
+ && pip install --no-cache-dir \
+    s3cmd==$S3CMD_VER \
+    ansible==$ANSIBLE_VER \
+    python-openstackclient==$OSC_VER

ansible/ansible.cfg

+[defaults]
+# change the default callback, you can only have one 'stdout' type  enabled at a time.
+#stdout_callback = skippy
+stdout_callback = yaml
+
+## Ansible ships with some plugins that require whitelisting,
+## this is done to avoid running all of a type by default.
+## These setting lists those that you want enabled for your system.
+## Custom plugins should not need this unless plugin author specifies it.
+
+# enable callback plugins, they can output to stdout but cannot be 'stdout' type.
+callbacks_enabled = timer, debug, profile_roles, profile_tasks, minimal
+
+# Force color
+force_color = true

ansible/base.yml

@@ -3,4 +3,5 @@
   hosts: default
   become: true
   roles:
+    - { name: 'fix_centos_repo', tags: 'fix_centos_repo' }
     - { name: 'install_packages', tags: 'install_packages' }

ansible/cheaha.yml

----
-- name: Setup node for use as a virtual cheaha node
-  hosts: default
-  become: true
-  roles:
-    - { name: 'cheaha.node', tags: 'cheaha.node' }
-    - { name: 'nfs_mounts', tags: 'nfs_mounts' }
-    - { name: 'ldap_config', tags: 'ldap_config' }
-    - { name: 'slurm_client', tags: 'slurm_client' }

ansible/cluster.yml

+---
+- name: Setup node for use as a virtual cheaha node
+  hosts: all
+  become: true
+  roles:
+    - { name: 'cheaha.node', tags: 'cheaha.node' }
+    - { name: 'nfs_mounts', tags: 'nfs_mounts', when: enable_nfs_mounts }
+    - { name: 'ldap_config', tags: 'ldap_config' }
+    - { name: 'slurm_client', tags: 'slurm_client', when: enable_slurm_client }
+    - { name: 'ssh_host_keys', tags: 'ssh_host_keys' }
+    - { name: 'ssh_proxy_config', tags: 'ssh_proxy_config', when: enable_ssh_proxy_config }
+    - { name: 'ssl_cert', tags: 'ssl_cert', when: enable_ssl_certs }
+    - { name: 'rsyslog_config', tags: 'rsyslog_config', when: enable_rsyslog_config }
+    - { name: 'rewrite_map', tags: 'rewrite_map', when: enable_rewrite_map }
+    - { name: 'fail2ban', tags: 'fail2ban', when: enable_fail2ban }
+    - { name: 'install_node_exporter', tags: 'install_node_exporter', when: enable_node_exporter }
+    - { name: 'ood_config', tags: 'ood_config', when: enable_ood_config }
+

ansible/files/nux-dextop.repo

 [nux-dextop]
 name=Nux.Ro RPMs for general desktop use
-baseurl=http://li.nux.ro/download/nux/dextop/el7/$basearch/ http://mirror.li.nux.ro/li.nux.ro/nux/dextop/el7/$basearch/
+baseurl=http://li.nux.ro/download/nux/dextop/el7/$basearch/
 enabled=1
 gpgcheck=1
 gpgkey=http://li.nux.ro/download/nux/RPM-GPG-KEY-nux.ro

ansible/gpu.yml

@@ -3,5 +3,11 @@
   hosts: default
   become: true
   roles:
+    - { name: 'fix_centos_repo', tags: 'fix_centos_repo' }
     - { name: 'install_packages', tags: 'install_packages' }
     - { name: 'cuda_driver', tags: 'cuda_driver' }
+    - { name: 'pam_slurm_adopt', tags: 'pam_slurm_adopt' }
+    - { name: 'install_nhc', tags: 'install_nhc'}
+
+- name: Setup node for use as a virtual cheaha node
+  ansible.builtin.import_playbook: cheaha.yml

ansible/group_vars/all

@@ -4,3 +4,103 @@
   yum_repo_files: []
   pkg_list: []
   slurm_version: 18.08.9
+  enable_slurm_client: false
+
+# NHC related
+  nhc_download_url: "https://github.com/mej/nhc/releases/download/1.4.3/lbnl-nhc-1.4.3-1.el7.noarch.rpm"
+  nhc_download_path: "/tmp"
+  nhc_git_repo: "https://gitlab.rc.uab.edu/rc/nhc.git"
+  nhc_git_repo_path: "/tmp/nhc"
+
+  root_ssh_key: ""
+
+# cheaha.node related
+  hostname_lookup_table:
+    - "10.141.255.254 master.cm.cluster master localmaster.cm.cluster localmaster ldapserver.cm.cluster ldapserver"
+  domain_search_list:
+    - openstack.internal
+    - cm.cluster
+  nameserver_list:
+    - 10.141.255.254
+
+# ldap_config related
+  ldap_cert_path: "/etc/openldap/certs"
+  ldap_uri: "ldap://ldapserver"
+
+# nfs_mounts related
+  enable_nfs_mounts: true
+  use_autofs: false
+  use_fstab: false
+  mount_points:
+    - { "src": "master:/gpfs4", "path": "/gpfs4", "opts": "ro,sync,hard", "mode": "0755" }
+    - { "src": "master:/gpfs5", "path": "/gpfs5", "opts": "ro,sync,hard", "mode": "0755" }
+  autofs_mounts:
+    - { "src": "master:/gpfs4/&", "path": "/gpfs4", "opts": "fstype=nfs,vers=3,_netdev,default", "mode": '0755', "mount_point": "/gpfs4", "map_name": "gpfs4", key: "*" }
+    - { "src": "master:/gpfs5/&", "path": "/gpfs5", "opts": "fstype=nfs,vers=3,_netdev,default", "mode": '0755', "mount_point": "/gpfs5", "map_name": "gpfs5", key: "*" }
+
+#SSH Host Keys
+  S3_ENDPOINT: ""
+  SSH_HOST_KEYS_S3_BUCKET: ""
+  SSH_HOST_KEYS_S3_OBJECT: ""
+
+# AWS credentials
+  LTS_ACCESS_KEY: ""
+  LTS_SECRET_KEY: ""
+
+# ssh proxy
+  enable_ssh_proxy_config: false
+  sshpiper_dest_dir: "/opt/sshpiper"
+
+# rsyslog
+  enable_rsyslog_config: true
+  rsyslog_target: "*.* @master:514"
+
+# ssl certs
+  enable_ssl_certs: false
+  ssl_cert_s3_bucket: ""
+  ssl_cert_key_location: "/etc/pki/tls/private"
+  ssl_cert_file_location: "/etc/pki/tls/certs"
+  ssl_cert_key: ""
+  ssl_cert_file: ""
+  ssl_cert_chain_file: ""
+  ssl_apache_config: ""
+  apache_service: "httpd"
+
+# rewrite map
+  enable_rewrite_map: false
+  target_groups:
+    - {"name": "gpfs4", "host": "login001", "default": True }
+    - {"name": "gpfs5", "host": "login002", "default": False }
+
+# account app
+  account_app_port: 8000
+
+# fail2ban
+  enable_fail2ban: false
+  maxretry: 1
+  findtime: 600
+  bantime: 1200
+  fail2ban_white_list: "127.0.0.1/8"
+
+# Node Exporter
+  enable_node_exporter: false
+  node_exporter_ver: "1.8.2"
+  node_exporter_filename: "node_exporter-{{ node_exporter_ver }}.linux-amd64"
+  node_exporter_user: node_exporter
+  node_exporter_group: node_exporter
+  node_exporter_port: 9100
+
+# CentOS Repo
+  centos_base_url: "http://vault.centos.org"
+
+# ood_config
+  enable_ood_config: false
+  ood_internal_ip: OOD_INTERNAL_IP
+  ood_hostname: ood-gpfs5
+  login_hostname: login001
+  ood_domain_name: rc.uab.edu
+  account_app: account
+  account_app_port: 8000
+  account_app_bind_address: ["0.0.0.0:{{account_app_port}}"]
+  ood_user_regex: "([^!]+?)(@uab.edu)?$"
+  cluster_name: CoD

ansible/group_vars/base

@@ -28,7 +28,6 @@
     - "OpenIPMI-libs"
     - "OpenIPMI-modalias"
     - "PackageKit-glib"
-    - "Red_Hat_Enterprise_Linux-Release_Notes-7-en-US"
     - "SDL"
     - "Thunar"
     - "abattis-cantarell-fonts"
@@ -75,7 +74,6 @@
     - "atkmm"
     - "atlas"
     - "atlas-devel"
-    - "atom"
     - "atril"
     - "atril-caja"
     - "atril-libs"
@@ -183,9 +181,6 @@
     - "cjkuni-uming-fonts"
     - "clucene-contribs-lib"
     - "clucene-core"
-    - "clusterkit"
-    - "clusterkit"
-    - "clusterkit"
     - "clutter"
     - "clutter-gst2"
     - "clutter-gst3"
@@ -277,7 +272,6 @@
     - "dracut-config-rescue"
     - "dracut-network"
     - "dstat"
-    - "dump_pr"
     - "dvd+rw-tools"
     - "dwz"
     - "dyninst"
@@ -399,7 +393,6 @@
     - "geoclue2"
     - "geoclue2-libs"
     - "geocode-glib"
-    - "geoipupdate"
     - "gettext"
     - "gettext-common-devel"
     - "gettext-devel"
@@ -471,16 +464,6 @@
     - "google-noto-emoji-fonts"
     - "gparted"
     - "gperftools-libs"
-    - "gpfs.base"
-    - "gpfs.callhome-ecc-client"
-    - "gpfs.docs"
-    - "gpfs.ext"
-    - "gpfs.gpl"
-    - "gpfs.gskit"
-    - "gpfs.gss.pmsensors"
-    - "gpfs.java"
-    - "gpfs.license.std"
-    - "gpfs.msg.en_US"
     - "gpgme"
     - "gpm-libs"
     - "graphite2"
@@ -590,7 +573,6 @@
     - "ibus-setup"
     - "ibus-table"
     - "ibus-table-chinese"
-    - "ibutils2"
     - "icedax"
     - "icedtea-web"
     - "ilmbase"
@@ -662,7 +644,6 @@
     - "keyutils-libs-devel"
     - "khmeros-base-fonts"
     - "khmeros-fonts-common"
-    - "knem"
     - "kpartx"
     - "kpatch"
     - "krb5-devel"
@@ -1301,7 +1282,6 @@
     - "mtools"
     - "mtr"
     - "mutter"
-    - "mxm"
     - "mythes"
     - "mythes-en"
     - "nano"
@@ -1375,7 +1355,6 @@
     - "opencore-amr"
     - "openjpeg-libs"
     - "openjpeg2"
-    - "openmpi"
     - "openscap"
     - "openscap-scanner"
     - "opensm"
@@ -1686,58 +1665,36 @@
     - "python-warlock"
     - "python-wrapt"
     - "python-yubico"
-    - "python2-adal"
     - "python2-asn1crypto"
-    - "python2-babel"
     - "python2-backports-functools_lru_cache"
     - "python2-blockdev"
     - "python2-boto"
     - "python2-certifi"
-    - "python2-chardet"
-    - "python2-cmd2"
-    - "python2-contextlib2"
     - "python2-crypto"
     - "python2-cryptography"
     - "python2-dateutil"
-    - "python2-extras"
     - "python2-futures"
-    - "python2-gunicorn"
     - "python2-idna"
     - "python2-iso8601"
     - "python2-jmespath"
     - "python2-jsonpatch"
-    - "python2-jsonpointer"
     - "python2-jsonschema"
-    - "python2-jwt"
-    - "python2-ldap"
-    - "python2-markupsafe"
     - "python2-mimeparse"
     - "python2-mock"
-    - "python2-monotonic"
     - "python2-msgpack"
-    - "python2-msrest"
-    - "python2-msrestazure"
-    - "python2-munch"
     - "python2-oauthlib"
     - "python2-olefile"
-    - "python2-os-service-types"
-    - "python2-pexpect"
-    - "python2-pillow"
     - "python2-pip"
     - "python2-ptyprocess"
     - "python2-pyasn1"
     - "python2-pyasn1-modules"
     - "python2-pyatspi"
-    - "python2-pyparsing"
-    - "python2-pyperclip"
     - "python2-pyxdg"
-    - "python2-requests"
     - "python2-rpm-macros"
     - "python2-rsa"
     - "python2-setuptools"
     - "python2-subprocess32"
     - "python2-traceback2"
-    - "python2-unittest2"
     - "python2-urllib3"
     - "python2-wcwidth"
     - "python3"
@@ -1758,9 +1715,6 @@
     - "pyusb"
     - "pyxattr"
     - "qemu-guest-agent"
-    - "qemu-img-ev"
-    - "qemu-kvm-common-ev"
-    - "qemu-kvm-ev"
     - "qpdf-libs"
     - "qrencode-libs"
     - "qt"
@@ -1798,7 +1752,6 @@
     - "redhat-lsb-submod-multimedia"
     - "redhat-lsb-submod-security"
     - "redhat-menus"
-    - "redhat-release-server"
     - "redhat-rpm-config"
     - "redhat-support-lib-python"
     - "redhat-support-tool"
@@ -1876,7 +1829,6 @@
     - "sgpio"
     - "shadow-utils"
     - "shared-mime-info"
-    - "sharp"
     - "shim-x64"
     - "sil-abyssinica-fonts"
     - "sil-nuosu-fonts"
@@ -2660,7 +2612,6 @@
     - "ttmkfdir"
     - "tumbler"
     - "tuned"
-    - "turbovnc"
     - "twolame-libs"
     - "tzdata"
     - "tzdata-java"

ansible/group_vars/compute

@@ -3,7 +3,7 @@
     - TurboVNC.repo
     - cm.repo
   pkg_list:
-    - "Lmod"
+    - "Lmod-7.8.11"
     - "atftp-server"
     - "cluster-tools-dell"
     - "cluster-tools-slave"
@@ -36,7 +36,6 @@
     - "cm-libprometheus"
     - "cm-lua"
     - "cm-mariadb-libs"
-    - "cm-modules-init-client"
     - "cm-openssl"
     - "cm-python2"
     - "cm-python36"
@@ -47,7 +46,6 @@
     - "cmdaemon"
     - "cmdaemon-remotecm"
     - "confuse"
-    - "env-modules"
     - "gcc-recent"
     - "gdb-recent"
     - "lshw"
@@ -61,43 +59,22 @@
     - "net-snmp-recent"
     - "node-installer-slave"
     - "openvpn"
-    - "pbspro-ce-client"
-    - "pbspro-client"
     - "perl-Config-IniFiles"
-    - "python-azure-sdk"
     - "python-dogpile-cache"
     - "python-isodate"
     - "python-netaddr"
     - "python-netifaces"
-    - "python-oslo-i18n-lang"
-    - "python-oslo-utils-lang"
     - "python-setuptools_scm"
     - "python-testtools"
-    - "python-vcrpy"
     - "python-websockify"
-    - "python2-cffi"
-    - "python2-cinderclient"
     - "python2-cliff"
     - "python2-debtcollector"
     - "python2-deprecation"
     - "python2-fixtures"
     - "python2-funcsigs"
-    - "python2-glanceclient"
-    - "python2-heatclient"
     - "python2-ipaddress"
-    - "python2-keystoneauth1"
-    - "python2-keystoneclient"
-    - "python2-novaclient"
-    - "python2-openstacksdk"
-    - "python2-os-client-config"
-    - "python2-osc-lib"
-    - "python2-oslo-config"
-    - "python2-oslo-i18n"
-    - "python2-oslo-serialization"
-    - "python2-oslo-utils"
     - "python2-pbr"
     - "python2-positional"
-    - "python2-pyOpenSSL"
     - "python2-pysocks"
     - "python2-pyyaml"
     - "python2-requests-oauthlib"
@@ -105,10 +82,7 @@
     - "python2-rfc3986"
     - "python2-six"
     - "python2-stevedore"
-    - "python2-swiftclient"
     - "sdparm"
-    - "sge-client"
-    - "shorewall"
     - "sshpass"
     - "swig"
-    - "turbovnc"
+    - "turbovnc-2.2.6*"

ansible/group_vars/gpu

 ---
-  yum_repo_files: []
+  yum_repo_files:
+    - TurboVNC.repo
+    - cm.repo
   pkg_list:
+    - "Lmod-7.8.11"
+    - "atftp-server"
+    - "cluster-tools-dell"
+    - "cluster-tools-slave"
+    - "cm-boost"
+    - "cm-config-ceph-release-luminous"
+    - "cm-config-cm"
+    - "cm-config-dhclient"
+    - "cm-config-dracut-slave"
+    - "cm-config-grub"
+    - "cm-config-ldap-client"
+    - "cm-config-limits"
+    - "cm-config-man"
+    - "cm-config-named"
+    - "cm-config-network-slave"
+    - "cm-config-nfsclient"
+    - "cm-config-rootfiles-slave"
+    - "cm-config-selinux"
+    - "cm-config-ssh-slave"
+    - "cm-config-sysctl-slave"
+    - "cm-config-syslog-slave"
+    - "cm-config-systemd"
+    - "cm-config-xntp-slave"
+    - "cm-config-yum"
+    - "cm-curl"
+    - "cm-dhcp"
+    - "cm-freeipmi"
+    - "cm-ipmitool"
+    - "cm-ipxe-slave"
+    - "cm-libpam"
+    - "cm-libprometheus"
+    - "cm-lua"
+    - "cm-mariadb-libs"
+    - "cm-openssl"
+    - "cm-python2"
+    - "cm-python36"
+    - "cm-slave"
+    - "cm-uge-client"
+    - "cmburn"
+    - "cmburn-slave"
+    - "cmdaemon"
+    - "cmdaemon-remotecm"
+    - "confuse"
+    - "gcc-recent"
+    - "gdb-recent"
+    - "lshw"
+    - "lua-bit32"
+    - "lua-filesystem"
+    - "lua-json"
+    - "lua-lpeg"
+    - "lua-posix"
+    - "lua-term"
+    - "mysql++"
+    - "net-snmp-recent"
+    - "node-installer-slave"
+    - "openvpn"
+    - "perl-Config-IniFiles"
+    - "python-dogpile-cache"
+    - "python-isodate"
+    - "python-netaddr"
+    - "python-netifaces"
+    - "python-setuptools_scm"
+    - "python-testtools"
+    - "python-websockify"
+    - "python2-cliff"
+    - "python2-debtcollector"
+    - "python2-deprecation"
+    - "python2-fixtures"
+    - "python2-funcsigs"
+    - "python2-ipaddress"
+    - "python2-pbr"
+    - "python2-positional"
+    - "python2-pysocks"
+    - "python2-pyyaml"
+    - "python2-requests-oauthlib"
+    - "python2-requestsexceptions"
+    - "python2-rfc3986"
+    - "python2-six"
+    - "python2-stevedore"
+    - "sdparm"
+    - "sshpass"
+    - "swig"
+    - "turbovnc-2.2.6*"
     - "cuda-dcgm"
     - "cuda-dcgm-libs"
     - "cuda-dcgm-nvvs"

ansible/group_vars/ood

@@ -2,6 +2,7 @@
   yum_repo_files:
     - cm.repo
   pkg_list:
+    - autofs
     - Lmod
     - tmux
     - vim

ansible/group_vars/prod

+---
+  # cheaha.node related
+  hostname_lookup_table:
+    - "172.20.0.24 cheaha-master02.cm.cluster cheaha-master02"
+    - "172.20.0.22 cheaha-master01.cm.cluster cheaha-master01"
+    - "172.20.0.25 master.cm.cluster master localmaster.cm.cluster localmaster ldapserver.cm.cluster ldapserver"
+  domain_search_list:
+    - cm.cluster
+    - rc.uab.edu
+    - ib.cluster
+    - drac.cluster
+    - eth.cluster
+    - ib-hdr.cluster
+  nameserver_list:
+    - 172.20.0.25
+
+  bright_openldap_path: "/cm/local/apps/openldap"
+  ldap_cert_path: "{{bright_openldap_path}}/etc/certs"
+  ldap_uri: "ldaps://ldapserver"
+
+  # proxy_config
+  target_groups:
+    - {"name": "gpfs5", "host": "login002", "default": False, "authorized_keys":"/gpfs5/data/user/home/$DOWNSTREAM_USER/.ssh/authorized_keys", "private_key":"/gpfs5/data/user/home/$DOWNSTREAM_USER/.ssh/id_ecdsa"}
+    - {"name": "gpfs4", "host": "login001", "default": True, "authorized_keys":"/gpfs4/data/user/home/$DOWNSTREAM_USER/.ssh/authorized_keys", "private_key":"/gpfs4/data/user/home/$DOWNSTREAM_USER/.ssh/id_ecdsa"}

ansible/compute.yml → ansible/login.yml

@@ -3,9 +3,7 @@
   hosts: default
   become: true
   roles:
+    - { name: 'fix_centos_repo', tags: 'fix_centos_repo' }
     - { name: 'install_packages', tags: 'install_packages' }
-    - { name: 'pam_slurm_adopt', tags: 'pam_slurm_adopt' }
-    - { name: 'lmod_user', tags: 'lmod_user'}
+    - { name: 'install_nhc', tags: 'install_nhc'}
 
-- name: Setup node for use as a virtual cheaha node
-  ansible.builtin.import_playbook: cheaha.yml

ansible/ood.yml

@@ -3,8 +3,6 @@
   hosts: default
   become: true
   roles:
+    - { name: 'fix_centos_repo', tags: 'fix_centos_repo' }
     - { name: 'install_packages', tags: 'install_packages' }
     - { name: 'install_zsh', tags: 'install_zsh' }
-
-- name: Setup node for use as a virtual cheaha node
-  ansible.builtin.import_playbook: cheaha.yml

ansible/roles/cheaha.node/tasks/main.yml

@@ -4,15 +4,24 @@
     path: /etc/hosts
     line: "{{ item }}"
   loop:
-    - "172.20.0.24 cheaha-master02.cm.cluster cheaha-master02"
-    - "172.20.0.22 cheaha-master01.cm.cluster cheaha-master01"
-    - "172.20.0.25 master.cm.cluster master localmaster.cm.cluster localmaster ldapserver.cm.cluster ldapserver"
+    "{{ hostname_lookup_table }}"
 
 - name: Add proper DNS search to lookup other nodes on the cluster
   ansible.builtin.lineinfile:
     path: /etc/dhcp/dhclient.conf
     insertbefore: BOF
     line: 'append domain-name " cm.cluster rc.uab.edu ib.cluster drac.cluster eth.cluster ib-hdr.cluster";'
+    create: true
+    state: present
+
+- name: Template resolv.conf
+  ansible.builtin.template:
+    src: resolv.conf.j2
+    dest: /etc/resolv.conf
+    owner: root
+    group: root
+    mode: 0644
+    backup: true
 
 - name: Disable SELinux
   ansible.posix.selinux:
@@ -25,6 +34,7 @@
     owner: root
     group: root
     mode: 0644
+  when: "'cm.repo' in yum_repo_files"
 
 - name: Add ssh key for root access
   ansible.posix.authorized_key:
@@ -35,3 +45,7 @@
 - name: Set timezone to America/Chicago
   community.general.timezone:
     name: America/Chicago
+  retries: 3
+  delay: 3
+  register: result
+  until: not result.failed

ansible/roles/cheaha.node/templates/resolv.conf.j2

+search {{ domain_search_list | join(' ') }}
+{% for name_server in nameserver_list %}
+nameserver {{ name_server }}
+{% endfor %}

ansible/roles/cuda_driver/tasks/main.yml

@@ -16,11 +16,11 @@
       - cuda-dcgm.x86_64
       - cuda-dcgm-libs
       - cuda-dcgm-devel
-    state: present
+    state: latest
 
 - name: start cuda-driver service
   ansible.builtin.systemd:
-    name: cuda-driver
+    name: "{{ item }}"
     state: started
     enabled: yes
   loop:

ansible/roles/fail2ban/tasks/main.yml

+---
+
+- name: Install fail2ban
+  ansible.builtin.package:
+    name: "{{ item }}"
+    state: present
+  loop:
+    - fail2ban
+    - fail2ban-firewalld
+
+- name: Configure fail2ban
+  ansible.builtin.template:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    backup: true
+  loop:
+    - { src: 'jail.local.j2', dest: '/etc/fail2ban/jail.local' }
+    - { src: 'sshpiperd_filter.local.j2', dest: '/etc/fail2ban/filter.d/sshpiperd.local' }
+    - { src: 'sshpiperd_jail.local.j2', dest: '/etc/fail2ban/jail.d/sshpiperd.local' }
+
+- name: Activate the firewalld support for fail2ban
+  ansible.builtin.command:
+    cmd: mv /etc/fail2ban/jail.d/00-firewalld.conf /etc/fail2ban/jail.d/00-firewalld.local
+
+- name: Configure firewalld to allow ssh and sshpiper traffic
+  ansible.posix.firewalld:
+    port: "{{ item }}"
+    zone: public
+    state: enabled
+    permanent: true
+  loop:
+    - 2222/tcp
+    - 22/tcp
+
+- name: Enable and start firewalld
+  ansible.builtin.service:
+    name: firewalld
+    enabled: true
+    state: restarted
+
+- name: Enable and start fail2ban
+  ansible.builtin.service:
+    name: fail2ban
+    enabled: true
+    state: restarted
+