Install fail2ban with IPv6 support from stretch-backports (Debian 9).

roles/common/tasks/security.yml

     state: present
   vars:
     packages:
-    - fail2ban
     - whois
     - lynis
     - rkhunter
   tags:
     - dependencies
 
+- name: Install newer fail2ban with IPv6 support
+  apt:
+    name: "fail2ban"
+    state: present
+    default_release: stretch-backports
+  tags:
+    - dependencies
+
 - name: Copy fail2ban configuration into place
   template: src=etc_fail2ban_jail.local.j2 dest=/etc/fail2ban/jail.local
   notify: restart fail2ban