---
- name: gather facts if required
  ansible.builtin.setup:
    gather_subset:
      - distribution
      - virtualization_type

- name: get supervisor IP address
  ansible.builtin.shell: "echo $SSH_CLIENT | tr -s '[:blank:]' ' ' | cut -d ' ' -f 1"
  register: ssh_client
  when: ansible_connection is not match("local")
  changed_when: false
  failed_when: ssh_client.stdout is falsy

- name: set fact
  ansible.builtin.set_fact:
    security_firewall_supervisor_ip: "{{ ssh_client.get('stdout', None) }}"
  changed_when: false

- name: install and configure nftables
  when: security_firewall_enabled is truthy
  become: true
  notify:
    - 'security : [firewall] restart service'
  block:
    - name: install nftables
      ansible.builtin.apt:
        pkg:
          - nftables

    - name: enable nftables
      ansible.builtin.systemd:
        name: nftables
        enabled: true
        masked: false

    - name: create config dir
      ansible.builtin.file:
        path: /etc/nftables.d
        mode: '0700'
        state: directory

    - name: set firewall templates facts
      ansible.builtin.set_fact:
        security_firewall_dns4_servers: "{{ hostvars[inventory_hostname]['global_dns_{}_dns4'.format(global_dns_type)] | default(ansible_facts.dns.nameservers | ansible.utils.ipv4, true) }}"
        security_firewall_dns6_servers: "{{ hostvars[inventory_hostname]['global_dns_{}_dns6'.format(global_dns_type)] | default(ansible_facts.dns.nameservers | ansible.utils.ipv6, true) }}"
        security_firewall_supervisor_has_ip6: "{{ true if security_firewall_supervisor_ip is defined and security_firewall_supervisor_ip and security_firewall_supervisor_ip | ansible.utils.ipv6 else false }}"

    - name: base config file
      ansible.builtin.template:
        src: "../templates/system/{{ ansible_facts['distribution'] | lower }}/nftables.conf.j2"
        dest: /etc/nftables.conf
        mode: '0700'

    - name: base tables definition
      ansible.builtin.template:
        src: "../templates/system/nftables/{{ item }}.table.j2"
        dest: "/etc/nftables.d/{{ item }}.table"
        mode: '0600'
      loop:
        - 01-nat
        - 02-mangle
        - 03-filter

    - name: common firewall rules
      ansible.builtin.template:
        src: "{{ item }}"
        dest: "/etc/nftables.d/{{ (item.split('/') | last)[:-3] }}"
        mode: '0600'
      loop: "{{ q('fileglob', '../templates/system/nftables.d/*.j2') }}"