Refresh Bitwarden's Fail2ban jail on a timer

roles/bitwarden/files/bitwarden.te

@@ -4,6 +4,7 @@ require {
     type container_t;
     type container_file_t;
     type container_ro_file_t;
+    type fail2ban_client_t;
     type oci_log_t;
     type unconfined_t;
     class process ptrace;
@@ -19,3 +20,4 @@ allow unconfined_t container_ro_file_t:file execmod;
 allow container_t oci_log_t:dir { read getattr search open lock ioctl write add_name remove_name create rmdir setattr rename reparent };
 allow container_t oci_log_t:file { read getattr open lock ioctl write append create unlink setattr rename link map };
 allow container_t oci_log_t:lnk_file { read getattr create unlink rename };
+allow fail2ban_client_t oci_log_t:dir read;

roles/bitwarden/handlers/main.yml

@@ -41,3 +41,9 @@
   become_user: "{{ bitwarden_user }}"
   environment: "{{ bitwarden_env }}"
   listen: rebuild_bitwarden
+
+- name: Restart Bitwarden's Fail2ban reload timer
+  ansible.builtin.systemd_service:
+    name: "fail2ban-reload-{{ bitwarden_name }}.timer"
+    state: restarted
+  listen: reload_bitwarden_jail

roles/bitwarden/tasks/main.yml

@@ -279,3 +279,28 @@
     dest: /etc/fail2ban/jail.d/bitwarden.conf
     mode: "640"
   notify: restart_fail2ban
+
+- name: Install Bitwarden's Fail2ban reload service
+  ansible.builtin.template:
+    src: fail2ban-reload.service.j2
+    dest: "/etc/systemd/system/fail2ban-reload-{{ bitwarden_name }}.service"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: reload_bitwarden_jail
+
+- name: Install Bitwarden's Fail2ban reload timer
+  ansible.builtin.template:
+    src: fail2ban-reload.timer.j2
+    dest: "/etc/systemd/system/fail2ban-reload-{{ bitwarden_name }}.timer"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: reload_bitwarden_jail
+
+- name: Enable Bitwarden's Fail2ban reload timer
+  ansible.builtin.systemd_service:
+    name: "fail2ban-reload-{{ bitwarden_name }}.timer"
+    enabled: true
+    state: started
+    daemon_reload: true

roles/bitwarden/templates/fail2ban-reload.service.j2

@@ -0,0 +1,10 @@
+# {{ ansible_managed }}
+[Unit]
+Description=Refresh the {{ bitwarden_name }} Fail2ban jail's log file list
+Documentation=man:fail2ban-client(1)
+After=fail2ban.service
+
+[Service]
+Type=oneshot
+ExecCondition=/usr/bin/systemctl is-active --quiet fail2ban.service
+ExecStart=/usr/bin/fail2ban-client reload {{ bitwarden_name }}

roles/bitwarden/templates/fail2ban-reload.timer.j2

@@ -0,0 +1,11 @@
+# {{ ansible_managed }}
+[Unit]
+Description=Periodic refresh of {{ bitwarden_name }}'s Fail2ban jail's log file list
+
+[Timer]
+OnCalendar=*:0/15
+AccuracySec=1m
+Persistent=true
+
+[Install]
+WantedBy=timers.target