Fail2Ban action configuration for Cloudflare. The current one that ships, by default, with Fail2Ban uses IP Access rules at User level. This one restricts it to a specific Zone (domain).

cloudflare-zone-ip-access.conf

# Fail2Ban action configuration file for CloudFlare REST API V4 using Authorization Bearer Token
#
# Author: Dale Rider
#
# This action depends on curl, python, jq, and xargs.
#
# To get your CloudFlare Authorization Bearer Token: https://dash.cloudflare.com/profile/api-tokens
# Your Authorization Bearer Token must have read-write-delete access to your firewall rules.
#
# CloudFlare API firewall rules documentation: https://developers.cloudflare.com/api/operations/ip-access-rules-for-a-zone-create-an-ip-access-rule
#
# How to use:
# 	Add your CloudFlare bearer token, Zone ID and the action call to the  [DEFAULT] section of your jail.local file:
#
# 	cftoken = c2547eb745079dac9320b638f5e225cf483cc5cfdda41
#   cfzone = eb745079dac9320b638f5e225cf483
#		action_cf_token = cloudflare-zone-ip-access[cfkey="%(cftoken)s",cfzoneid="%(cfzone)s"]
#
#	Set the default action in the [DEFAULT] section, or override the default action in a jail:
#		action = %(action_cf_token)s

[Definition]

# Option:  actionstart
# Notes.:  command executed once at the start of Fail2Ban.
# Values:  CMD
#
actionstart =

# Option:  actionstop
# Notes.:  command executed once at the end of Fail2Ban
# Values:  CMD
#
actionstop =

# Option:  actioncheck
# Notes.:  command executed once before each actionban command
# Values:  CMD
#
actioncheck =

# Option:  actionban
# Notes.:  command executed when banning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    <ip>  IP address
#          <failures>  number of failures
#          <time>  unix timestamp of the ban time
# Values:  CMD
#
actionban = curl -s -X POST https://api.cloudflare.com/client/v4/zones/<cfzoneid>/firewall/access_rules/rules \
	-H "Authorization: Bearer <cfkey>" -H "Content-Type: application/json" \
	--data '{"mode":"block","configuration":{"target":"ip","value":"<ip>"},"notes":"Fail2Ban by Zone"}'

# Option:  actionunban
# Notes.:  command executed when unbanning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    <ip>  IP address
#          <failures>  number of failures
#          <time>  unix timestamp of the ban time
# Values:  CMD
#

actionunban = curl -s -X DELETE -H 'Authorization: Bearer <cfkey>' \
              https://api.cloudflare.com/client/v4/zones/<cfzoneid>/firewall/access_rules/rules/$(curl -s -X GET -H 'Authorization: Bearer <cfkey>' \
              'https://api.cloudflare.com/client/v4/zones/<cfzoneid>/firewall/access_rules/rules?mode=block&configuration_target=ip&configuration_value=<ip>&page=1&per_page=1&notes=Fail2Ban by Zone&match=all' | jq -r '.result[] | .id')

[Init]

# Declare your CloudFlare Authorization Bearer Token in the [DEFAULT] section of your jail.local file.
# Example:
#	cftoken = c2547eb745079dac9320b638f5e225cf483cc5cfdda41

cfkey = 
cfzoneid =