If your SSH logins are key-only (and they should be) then fail2ban is unnecessary IMO. No one is going to gain access without your private key, and while it's a

If your SSH logins are key-only (and they should be) then fail2ban is unnecessary IMO. No one is going to gain access without your private key, and while it's a nice feeling that the bad actors are "blocked" - fail2ban is using more resources to block them than their attempts are using. Assuming you aren't getting 1000s per minute, of course.