---
- include_tasks: setup.yml
  when: firewalld_enabled | bool

- name: Ensure service has expected state
  service:
    name: firewalld
    daemon_reload: True
    enabled: "{{ firewalld_enabled | bool }}"
    masked: "{{ not firewalld_enabled | bool }}"
    state: "{{ firewalld_enabled | bool | ternary('started', 'stopped', 'started') }}"
  become: True
  become_user: root