Exercise 1: The fail2ban Role's Own Template Task — Possible Solution
====================================================================

roles/fail2ban/tasks/main.yml:

- name: Deploy fail2ban jail config
  template:
    src: jail.local.j2
    dest: /etc/fail2ban/jail.local
  notify: restart fail2ban

roles/fail2ban/handlers/main.yml:

- name: restart fail2ban
  service:
    name: fail2ban
    state: restarted

Explanation:

This is the chapter's own fail2ban role task, placed correctly within
the standard tasks/main.yml and handlers/main.yml files per
ansible1-7's own role directory structure. The template module
(ansible1-5) renders jail.local.j2 through Jinja2 and deploys the
result to /etc/fail2ban/jail.local. The notify: restart fail2ban line
only actually triggers the handler when the template task itself
reports changed -- exactly ansible1-6's own principle: if
jail.local's rendered content is identical to what's already on disk
(nothing changed), the handler never fires, and fail2ban is never
needlessly restarted. Only a genuine change to the underlying
variables feeding the template -- and therefore to the rendered
file's actual content -- causes both the "changed" report and the
resulting restart.

WHY THIS WORKS AS AN ANSWER
------------------------------
This places the task and its handler in the correct role
subdirectories per ansible1-7's own structure, and explicitly
explains why the notify only fires conditionally on a genuine content
change rather than on every playbook run, directly citing ansible1-6's
own restart-on-change principle.