I try to only deploy fail2ban Apache jails if apache is actually installed. I have a fact for that that works.
# fail2ban $jails = [ \'ssh\', \'ssh-ddos