diff --git a/playbooks/hosts/hrf.cloud.fedoraproject.org.yml b/playbooks/hosts/hrf.cloud.fedoraproject.org.yml
index 0bc693fb91..6dc504b4c9 100644
--- a/playbooks/hosts/hrf.cloud.fedoraproject.org.yml
+++ b/playbooks/hosts/hrf.cloud.fedoraproject.org.yml
@@ -47,7 +47,13 @@
         - mod_wsgi
         - htop # not a dep, but handy
         - git
+        - fail2ban
+
+    - name: enable fail2ban and start it
+      shell: chkconfig fail2ban on && service fail2ban start
+
     - name: clone the flask repo
       git: repo=git://github.com/fedora-infra/hrf.git dest=/srv/www/hrf
+
     - name: enable port 80
       command: lokkit -p '80:tcp'