roles/debian-base/defaults/main.yaml

@@ -5,6 +5,7 @@ fail2ban:
   bantime: 600
   maxretry: 4
   ignore: "127.0.0.0/8 {{ dc_net }}"
+  logpath: "/var/log/auth.log"
 fail2ban_base_packages:
   - fail2ban
   - rsyslog

roles/debian-base/templates/jail.local

@@ -17,4 +17,4 @@ action    = %(action_)s
 enabled   = true
 port      = 0:65535
 filter    = sshd
-logpath   = %(sshd_log)s
+logpath   = {{ fail2ban.logpath }}