65 lines
1.7 KiB
YAML
65 lines
1.7 KiB
YAML
---
|
|
- name: gather facts if required
|
|
ansible.builtin.setup:
|
|
gather_subset:
|
|
- distribution
|
|
- virtualization_type
|
|
|
|
- name: get supervisor IP address
|
|
ansible.builtin.shell: "echo $SSH_CLIENT | tr -s '[:blank:]' ' ' | cut -d ' ' -f 1"
|
|
register: ssh_client
|
|
changed_when: false
|
|
failed_when: ssh_client.stdout is falsy
|
|
|
|
- name: set fact
|
|
ansible.builtin.set_fact:
|
|
supervisor_ip: "{{ ssh_client.stdout }}"
|
|
changed_when: false
|
|
|
|
- name: install and configure nftables
|
|
when: security.firewall.enable is truthy
|
|
become: true
|
|
notify:
|
|
- 'security : [firewall] restart service'
|
|
block:
|
|
- name: install nftables
|
|
ansible.builtin.apt:
|
|
pkg:
|
|
- nftables
|
|
|
|
- name: enable nftables
|
|
ansible.builtin.systemd:
|
|
name: nftables
|
|
enabled: true
|
|
masked: false
|
|
|
|
- name: create config dir
|
|
ansible.builtin.file:
|
|
path: /etc/nftables.d
|
|
mode: '0700'
|
|
state: directory
|
|
|
|
- name: base config file
|
|
ansible.builtin.template:
|
|
src: "../templates/system/{{ ansible_facts['distribution'] | lower }}/nftables.conf.j2"
|
|
dest: /etc/nftables.conf
|
|
mode: '0700'
|
|
|
|
- name: base tables definition
|
|
ansible.builtin.template:
|
|
src: "../templates/system/nftables/{{ item }}.table.j2"
|
|
dest: "/etc/nftables.d/{{ item }}.table"
|
|
mode: '0600'
|
|
vars:
|
|
firewall: "{{ security.firewall }}"
|
|
loop:
|
|
- 01-nat
|
|
- 02-mangle
|
|
- 03-filter
|
|
|
|
- name: common firewall rules
|
|
ansible.builtin.template:
|
|
src: "{{ item }}"
|
|
dest: "/etc/nftables.d/{{ (item.split('/') | last)[:-3] }}"
|
|
mode: '0600'
|
|
loop: "{{ q('fileglob', '../templates/system/nftables.d/*.j2') }}"
|