move fail2ban into setup block (from webServer)