From 6763c2bc2941f4c3be939f527302de6760e0ba50 Mon Sep 17 00:00:00 2001
From: Kris Lamoureux <kris@lamoureux.io>
Date: Sun, 13 Sep 2026 20:15:16 -0400
Subject: [PATCH] Refresh Bitwarden's Fail2ban jail on a timer

---
 roles/bitwarden/files/bitwarden.te            |  2 ++
 roles/bitwarden/handlers/main.yml             |  6 +++++
 roles/bitwarden/tasks/main.yml                | 25 +++++++++++++++++++
 .../templates/fail2ban-reload.service.j2      | 10 ++++++++
 .../templates/fail2ban-reload.timer.j2        | 11 ++++++++
 5 files changed, 54 insertions(+)
 create mode 100644 roles/bitwarden/templates/fail2ban-reload.service.j2
 create mode 100644 roles/bitwarden/templates/fail2ban-reload.timer.j2

diff --git a/roles/bitwarden/files/bitwarden.te b/roles/bitwarden/files/bitwarden.te
index 52ad152..beae593 100644
--- a/roles/bitwarden/files/bitwarden.te
+++ b/roles/bitwarden/files/bitwarden.te
@@ -4,6 +4,7 @@ require {
     type container_t;
     type container_file_t;
     type container_ro_file_t;
+    type fail2ban_client_t;
     type oci_log_t;
     type unconfined_t;
     class process ptrace;
@@ -19,3 +20,4 @@ allow unconfined_t container_ro_file_t:file execmod;
 allow container_t oci_log_t:dir { read getattr search open lock ioctl write add_name remove_name create rmdir setattr rename reparent };
 allow container_t oci_log_t:file { read getattr open lock ioctl write append create unlink setattr rename link map };
 allow container_t oci_log_t:lnk_file { read getattr create unlink rename };
+allow fail2ban_client_t oci_log_t:dir read;
diff --git a/roles/bitwarden/handlers/main.yml b/roles/bitwarden/handlers/main.yml
index 0c093c6..ad0774b 100644
--- a/roles/bitwarden/handlers/main.yml
+++ b/roles/bitwarden/handlers/main.yml
@@ -41,3 +41,9 @@
   become_user: "{{ bitwarden_user }}"
   environment: "{{ bitwarden_env }}"
   listen: rebuild_bitwarden
+
+- name: Restart Bitwarden's Fail2ban reload timer
+  ansible.builtin.systemd_service:
+    name: "fail2ban-reload-{{ bitwarden_name }}.timer"
+    state: restarted
+  listen: reload_bitwarden_jail
diff --git a/roles/bitwarden/tasks/main.yml b/roles/bitwarden/tasks/main.yml
index a34216d..afd7a5b 100644
--- a/roles/bitwarden/tasks/main.yml
+++ b/roles/bitwarden/tasks/main.yml
@@ -279,3 +279,28 @@
     dest: /etc/fail2ban/jail.d/bitwarden.conf
     mode: "640"
   notify: restart_fail2ban
+
+- name: Install Bitwarden's Fail2ban reload service
+  ansible.builtin.template:
+    src: fail2ban-reload.service.j2
+    dest: "/etc/systemd/system/fail2ban-reload-{{ bitwarden_name }}.service"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: reload_bitwarden_jail
+
+- name: Install Bitwarden's Fail2ban reload timer
+  ansible.builtin.template:
+    src: fail2ban-reload.timer.j2
+    dest: "/etc/systemd/system/fail2ban-reload-{{ bitwarden_name }}.timer"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: reload_bitwarden_jail
+
+- name: Enable Bitwarden's Fail2ban reload timer
+  ansible.builtin.systemd_service:
+    name: "fail2ban-reload-{{ bitwarden_name }}.timer"
+    enabled: true
+    state: started
+    daemon_reload: true
diff --git a/roles/bitwarden/templates/fail2ban-reload.service.j2 b/roles/bitwarden/templates/fail2ban-reload.service.j2
new file mode 100644
index 0000000..12e9f11
--- /dev/null
+++ b/roles/bitwarden/templates/fail2ban-reload.service.j2
@@ -0,0 +1,10 @@
+# {{ ansible_managed }}
+[Unit]
+Description=Refresh the {{ bitwarden_name }} Fail2ban jail's log file list
+Documentation=man:fail2ban-client(1)
+After=fail2ban.service
+
+[Service]
+Type=oneshot
+ExecCondition=/usr/bin/systemctl is-active --quiet fail2ban.service
+ExecStart=/usr/bin/fail2ban-client reload {{ bitwarden_name }}
diff --git a/roles/bitwarden/templates/fail2ban-reload.timer.j2 b/roles/bitwarden/templates/fail2ban-reload.timer.j2
new file mode 100644
index 0000000..194a549
--- /dev/null
+++ b/roles/bitwarden/templates/fail2ban-reload.timer.j2
@@ -0,0 +1,11 @@
+# {{ ansible_managed }}
+[Unit]
+Description=Periodic refresh of {{ bitwarden_name }}'s Fail2ban jail's log file list
+
+[Timer]
+OnCalendar=*:0/15
+AccuracySec=1m
+Persistent=true
+
+[Install]
+WantedBy=timers.target