73 lines
2.5 KiB
YAML
73 lines
2.5 KiB
YAML
---
|
|
- name: gather facts if required
|
|
ansible.builtin.setup:
|
|
gather_subset:
|
|
- distribution
|
|
- virtualization_type
|
|
|
|
- name: get supervisor IP address
|
|
ansible.builtin.shell: "echo $SSH_CLIENT | tr -s '[:blank:]' ' ' | cut -d ' ' -f 1"
|
|
register: ssh_client
|
|
when: ansible_connection is not match("local")
|
|
changed_when: false
|
|
failed_when: ssh_client.stdout is falsy
|
|
|
|
- name: set fact
|
|
ansible.builtin.set_fact:
|
|
security_firewall_supervisor_ip: "{{ ssh_client.get('stdout', None) }}"
|
|
changed_when: false
|
|
|
|
- name: install and configure nftables
|
|
when: security_firewall_enabled is truthy
|
|
become: true
|
|
notify:
|
|
- 'security : [firewall] restart service'
|
|
block:
|
|
- name: install nftables
|
|
ansible.builtin.apt:
|
|
pkg:
|
|
- nftables
|
|
|
|
- name: enable nftables
|
|
ansible.builtin.systemd:
|
|
name: nftables
|
|
enabled: true
|
|
masked: false
|
|
|
|
- name: create config dir
|
|
ansible.builtin.file:
|
|
path: /etc/nftables.d
|
|
mode: '0700'
|
|
state: directory
|
|
|
|
- name: set firewall templates facts
|
|
ansible.builtin.set_fact:
|
|
security_firewall_dns4_servers: "{{ hostvars[inventory_hostname]['global_dns_{}_dns4'.format(global_dns_type)] | default(ansible_facts.dns.nameservers | ansible.utils.ipv4, true) }}"
|
|
security_firewall_dns6_servers: "{{ hostvars[inventory_hostname]['global_dns_{}_dns6'.format(global_dns_type)] | default(ansible_facts.dns.nameservers | ansible.utils.ipv6, true) }}"
|
|
security_firewall_supervisor_has_ip6: "{{ true if security_firewall_supervisor_ip is defined and security_firewall_supervisor_ip and security_firewall_supervisor_ip | ansible.utils.ipv6 else false }}"
|
|
|
|
- name: base config file
|
|
ansible.builtin.template:
|
|
src: "../templates/system/{{ ansible_facts['distribution'] | lower }}/nftables.conf.j2"
|
|
dest: /etc/nftables.conf
|
|
mode: '0700'
|
|
|
|
- name: base tables definition
|
|
ansible.builtin.template:
|
|
src: "../templates/system/nftables/{{ item }}.table.j2"
|
|
dest: "/etc/nftables.d/{{ item }}.table"
|
|
mode: '0600'
|
|
loop:
|
|
- 01-nat
|
|
- 02-mangle
|
|
- 03-filter
|
|
|
|
- name: common firewall rules
|
|
ansible.builtin.template:
|
|
src: "{{ item }}"
|
|
dest: "/etc/nftables.d/{{ (item.split('/') | last)[:-3] }}"
|
|
mode: '0600'
|
|
loop: "{{ q('fileglob', '../templates/system/nftables.d/*.j2') }}"
|
|
|
|
- name: flush handlers
|
|
ansible.builtin.meta: flush_handlers
|