62 lines
2.1 KiB
YAML
62 lines
2.1 KiB
YAML
---
|
|
- name: gather facts if required
|
|
ansible.builtin.setup:
|
|
gather_subset:
|
|
- distribution
|
|
- virtualization_type
|
|
|
|
- name: install and configure nftables
|
|
when: security_firewall_enabled is truthy
|
|
become: true
|
|
notify:
|
|
- 'security : [firewall] restart service'
|
|
block:
|
|
- name: install nftables
|
|
ansible.builtin.apt:
|
|
pkg:
|
|
- nftables
|
|
|
|
- name: enable nftables
|
|
ansible.builtin.systemd:
|
|
name: nftables
|
|
enabled: true
|
|
masked: false
|
|
|
|
- name: create config dir
|
|
ansible.builtin.file:
|
|
path: /etc/nftables.d
|
|
mode: '0700'
|
|
state: directory
|
|
|
|
- name: set firewall templates facts
|
|
ansible.builtin.set_fact:
|
|
security_firewall_supervisors_ip4: '{{ provisioner_facts.controllers_list.values() | list | ansible.utils.ipv4 }}'
|
|
security_firewall_supervisors_ip6: '{{ provisioner_facts.controllers_list.values() | list | ansible.utils.ipv6 }}'
|
|
security_firewall_dns4_servers: "{{ hostvars[inventory_hostname]['global_dns_{}_dns4'.format(global_dns_type)] | default(ansible_facts.dns.nameservers | ansible.utils.ipv4, true) }}"
|
|
security_firewall_dns6_servers: "{{ hostvars[inventory_hostname]['global_dns_{}_dns6'.format(global_dns_type)] | default(ansible_facts.dns.nameservers | ansible.utils.ipv6, true) }}"
|
|
|
|
- name: base config file
|
|
ansible.builtin.template:
|
|
src: "../templates/system/{{ ansible_facts['distribution'] | lower }}/nftables.conf.j2"
|
|
dest: /etc/nftables.conf
|
|
mode: '0700'
|
|
|
|
- name: base tables definition
|
|
ansible.builtin.template:
|
|
src: "../templates/system/nftables/{{ item }}.table.j2"
|
|
dest: "/etc/nftables.d/{{ item }}.table"
|
|
mode: '0600'
|
|
loop:
|
|
- 01-nat
|
|
- 02-mangle
|
|
- 03-filter
|
|
|
|
- name: common firewall rules
|
|
ansible.builtin.template:
|
|
src: "{{ item }}"
|
|
dest: "/etc/nftables.d/{{ (item.split('/') | last)[:-3] }}"
|
|
mode: '0600'
|
|
loop: "{{ q('fileglob', '../templates/system/nftables.d/*.j2') }}"
|
|
|
|
- name: flush handlers
|
|
ansible.builtin.meta: flush_handlers
|