refactor!: switch hosts variables to a flat layout

collections/ansible_collections/nullified/infrastructure/roles/security/tasks/firewall.yml

@@ -8,16 +8,17 @@
 - name: get supervisor IP address
   ansible.builtin.shell: "echo $SSH_CLIENT | tr -s '[:blank:]' ' ' | cut -d ' ' -f 1"
   register: ssh_client
+  when: ansible_connection is not match("local")
   changed_when: false
   failed_when: ssh_client.stdout is falsy
 
 - name: set fact
   ansible.builtin.set_fact:
-    supervisor_ip: "{{ ssh_client.stdout }}"
+    security_firewall_supervisor_ip: "{{ ssh_client.get('stdout', None) }}"
   changed_when: false
 
 - name: install and configure nftables
-  when: security.firewall.enable is truthy
+  when: security_firewall_enabled is truthy
   become: true
   notify:
     - 'security : [firewall] restart service'
@@ -39,6 +40,12 @@
         mode: '0700'
         state: directory
 
+    - name: set firewall templates facts
+      ansible.builtin.set_fact:
+        security_firewall_dns4_servers: "{{ hostvars[inventory_hostname]['global_dns_{}_dns4'.format(global_dns_type)] | default(ansible_facts.dns.nameservers | ansible.utils.ipv4, true) }}"
+        security_firewall_dns6_servers: "{{ hostvars[inventory_hostname]['global_dns_{}_dns6'.format(global_dns_type)] | default(ansible_facts.dns.nameservers | ansible.utils.ipv6, true) }}"
+        security_firewall_supervisor_has_ip6: "{{ true if security_firewall_supervisor_ip is defined and security_firewall_supervisor_ip and security_firewall_supervisor_ip | ansible.utils.ipv6 else false }}"
+
     - name: base config file
       ansible.builtin.template:
         src: "../templates/system/{{ ansible_facts['distribution'] | lower }}/nftables.conf.j2"
@@ -50,8 +57,6 @@
         src: "../templates/system/nftables/{{ item }}.table.j2"
         dest: "/etc/nftables.d/{{ item }}.table"
         mode: '0600'
-      vars:
-        firewall: "{{ security.firewall }}"
       loop:
         - 01-nat
         - 02-mangle

collections/ansible_collections/nullified/infrastructure/roles/security/tasks/main.yml

@@ -4,16 +4,11 @@
     gather_subset:
       - distribution
 
-- name: '[setup] merge with custom vars'
-  ansible.builtin.set_fact:
-    security: "{{ security | combine(custom_security, recursive=recursive_combine) }}"
-  changed_when: false
-
 - include_tasks: firewall.yml
 
 - name: '[apt] force HTTPS sources'
   become: true
-  when: security.apt.force_https is truthy
+  when: security_apt_force_https is truthy
   block:
     - name: '[apt] fetch apt information'
       ansible.builtin.command:
@@ -25,7 +20,7 @@
         path: "{{ item }}"
         regexp: 'http://'
         replace: 'https://'
-      loop: "{{ apt_source_files.stdout_lines | difference(security.apt.https_ignore_list) }}"
+      loop: "{{ apt_source_files.stdout_lines | difference(security_apt_https_ignore_list) }}"
       notify:
         - 'security : [apt] update sources'
 
@@ -98,7 +93,7 @@
   block:
     - name: '[clamav] retrieve and install clamav package'
       ansible.builtin.apt:
-        deb: https://www.clamav.net/downloads/production/clamav-{{ security.clamav.version }}.linux.x86_64.deb
+        deb: https://www.clamav.net/downloads/production/clamav-{{ security_clamav_version }}.linux.x86_64.deb
         force_apt_get: true
         state: present
     - name: '[clamav] add clamav group'