xoxys.firewalld/tasks/setup.yml
Robert Kaussow e2cc2fb381
All checks were successful
continuous-integration/drone/push Build is passing
feat: add option to disable firewalld
2022-10-17 08:47:09 +02:00

105 lines
3.1 KiB
YAML

---
- block:
- name: Install packages
package:
name: "{{ item }}"
loop:
- firewalld
- python3-firewall
- name: Configure firewalld
template:
src: etc/firewalld/firewalld.conf.j2
dest: /etc/firewalld/firewalld.conf
mode: 0644
notify: __firewalld_reload
- name: Configure firewalld ipsets
template:
src: etc/firewalld/ipsets/ipset.xml.j2
dest: /etc/firewalld/ipsets/{{ item.name }}.xml
mode: 0640
loop: "{{ __firewalld_ipsets }}"
loop_control:
label: "{{ item.name }}"
notify: __firewalld_reload
- name: Register active ipsets
find:
paths: /etc/firewalld/ipsets
file_type: file
patterns: "*.xml"
register: __firewalld_ipsets_active
changed_when: False
failed_when: False
- name: Remove unmanaged ipsets
file:
path: "{{ item }}"
state: absent
loop: "{{ __firewalld_ipsets_active.files | map(attribute='path') | list }}"
notify: __firewalld_reload
when: (item | basename | splitext | first) not in (__firewalld_ipsets | map(attribute='name') | list)
- name: Configure firewalld services
template:
src: etc/firewalld/services/service.xml.j2
dest: /etc/firewalld/services/{{ item.name }}.xml
mode: 0640
loop: "{{ __firewalld_services }}"
loop_control:
label: "{{ item.name }}"
notify: __firewalld_reload
- name: Register active services
find:
paths: /etc/firewalld/services
file_type: file
patterns: "*.xml"
register: __firewalld_services_active
changed_when: False
failed_when: False
- name: Remove unmanaged services
file:
path: "{{ item }}"
state: absent
loop: "{{ __firewalld_services_active.files | map(attribute='path') | list }}"
notify: __firewalld_reload
when: (item | basename | splitext | first) not in (__firewalld_services | map(attribute='name') | list)
- name: Configure firewalld zones
template:
src: etc/firewalld/zones/zone.xml.j2
dest: /etc/firewalld/zones/{{ item.name }}.xml
mode: 0640
loop: "{{ __firewalld_zones }}"
loop_control:
label: "{{ item.name }}"
notify: __firewalld_reload
- name: Register active zones
find:
paths: /etc/firewalld/zones
file_type: file
patterns: "*.xml"
register: __firewalld_zones_active
changed_when: False
failed_when: False
- name: Remove unmanaged zones
file:
path: "{{ item }}"
state: absent
loop: "{{ __firewalld_zones_active.files | map(attribute='path') | list }}"
notify: __firewalld_reload
when: (item | basename | splitext | first) not in (__firewalld_zones | map(attribute='name') | list)
- name: Validate deployed configuration
command: firewall-offline-cmd --check-config
register: __firewalld_check
changed_when: False
failed_when: __firewalld_check.rc != 0
become: True
become_user: root