let's try this again with destroy

ubuntu/roles/firewall-ruleset-deploy/files/deirdre.asininetech.net.rules.v4

@@ -4,7 +4,7 @@
 :INPUT DROP
 :FORWARD DROP
 :OUTPUT DROP
-#-A INPUT -m set --match-set nasties src -j DROP
+-A INPUT -m set --match-set nasties src -j DROP
 -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
 -A INPUT -i lo -j ACCEPT
 -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT

ubuntu/roles/ipset-deploy/tasks/main.yml

@@ -1,9 +1,9 @@
 ---
 # This role deploys ipset rulesets to Ubuntu hosts
 
-- name: Flush any existing ipsets
+- name: Destroy any existing ipsets
   shell:
-    cmd: /sbin/ipset flush
+    cmd: /sbin/ipset destroy
 
 - name: Copy ipset.service
   copy: