[Fixes #54676186] mirror security

- adds everyone with prod access
- installs fail2ban and ufw
- includes ssh module which ensures only key-based login

Now allows port 22.
I have a question about variable naming, below. It is good to merge due to several merges from master :smile: