Rebasing the latest bedrock-ansible and doing a provisioning solves the problem of fail2ban. I think I might be able to figure the rest out now. So this thread can be closed but I think this highlights my other thread where I’m curious if a new release version of bedrock-ansible is on the roadmap.