ansible.nftables/tasks/main.yml

183 lines
5.0 KiB
YAML
Raw Normal View History

2017-08-07 12:09:13 +02:00
---
# .. vim: foldmarker=[[[,]]]:foldmethod=marker
#
2017-08-07 12:09:13 +02:00
# tasks file for nftables
2020-11-11 15:27:08 +01:00
- name: Check for group files
become: no
delegate_to: localhost
stat:
path: "{{ nft_merged_groups_dir ~ groupname }}"
register: nftables_group_rules
loop: "{{ group_names }}"
loop_control:
loop_var: groupname
- debug: var=nftables_group_rules
when: nft_debug
- name: Import nftables-variables if nft_merged_groups is set
when: nft_merged_groups and varfile.stat.exists
include_vars:
file: "{{ nft_merged_groups_dir ~ varfile.groupname }}"
name: "{{ varfile.groupname }}"
loop: "{{ nftables_group_rules.results }}"
loop_control:
loop_var: varfile
- name: Combine Rules when nft_merged_groups is set
when: nft_merged_groups and
((hostvars[inventory_hostname][varfile.groupname] is defined) and
(hostvars[inventory_hostname][varfile.groupname]|length > 0)) and
varfile.stat.exists
set_fact:
nft_combined_rules: "{{ nft_combined_rules | default({}) | combine ( hostvars[inventory_hostname][varfile.groupname], recursive=True ) }}"
loop: "{{ nftables_group_rules.results }}"
loop_control:
loop_var: varfile
2017-08-07 12:09:13 +02:00
- debug: var=nft_combined_rules
when: nft_debug
- name: Load specific OS vars for nftables
include_vars: "{{ osname }}"
2017-08-07 12:09:13 +02:00
with_first_found:
- "{{ ansible_distribution|lower }}-{{ ansible_distribution_version }}.yml"
- "{{ ansible_distribution|lower }}.yml"
- "{{ ansible_os_family|lower }}.yml"
loop_control:
loop_var: osname
2017-08-07 12:09:13 +02:00
# Manage packages [[[1
- name: Ensure Nftables packages are in their desired state
2017-08-07 12:09:13 +02:00
package:
name: '{{ nft_pkg_list | list }}'
2017-08-07 12:09:13 +02:00
state: '{{ nft_pkg_state }}'
register: pkg_install_result
until: pkg_install_result is success
when: nft_enabled|bool
2017-08-07 12:09:13 +02:00
- name: Ensure old Iptables packages are in their desired state
2020-11-11 15:27:08 +01:00
package:
name: '{{ nft_old_pkg_list | list }}'
state: '{{ nft_old_pkg_state }}'
register: pkg_remove_result
until: pkg_remove_result is success
when: (nft_enabled|bool and
nft_old_pkg_manage|bool)
# Common configuration [[[1
- name: Ensure to create nftables.d directory
file:
path: "{{ nft_conf_dir_path }}"
state: directory
mode: 0755
when: nft_enabled|bool
- name: CONFIG generate main conf file
2017-08-07 13:48:54 +02:00
template:
src: "{{ nft_main_conf_content }}"
dest: "{{ nft_main_conf_path }}"
owner: root
group: root
mode: 0755
backup: "{{ nft_backup_conf }}"
notify: ['Reload nftables service']
when: nft_enabled|bool
2017-08-07 17:37:41 +02:00
- name: CONFIG generate vars definition file
2017-08-07 17:37:41 +02:00
template:
src: "{{ nft_define_conf_content }}"
dest: "{{ nft_define_conf_path }}"
2017-08-07 17:37:41 +02:00
owner: root
group: root
mode: 0755
backup: "{{ nft_backup_conf }}"
notify: ['Reload nftables service']
when: nft_enabled|bool
2017-08-08 12:11:58 +02:00
- name: CONFIG generate sets file
2017-08-08 15:35:05 +02:00
template:
src: "{{ nft_set_conf_content }}"
dest: "{{ nft_set_conf_path }}"
2017-08-08 15:35:05 +02:00
owner: root
group: root
mode: 0755
backup: "{{ nft_backup_conf }}"
notify: ['Reload nftables service']
when: nft_enabled|bool
2017-08-08 15:35:05 +02:00
# Filter table content [[[1
- name: Filter table - generate input rules file
2017-08-08 12:11:58 +02:00
template:
src: "{{ nft_input_conf_content }}"
dest: "{{ nft_input_conf_path }}"
2017-08-08 12:11:58 +02:00
owner: root
group: root
mode: 0755
backup: "{{ nft_backup_conf }}"
notify: ['Reload nftables service']
when: nft_enabled|bool
- name: Filter table - generate output rules file
template:
src: "{{ nft_output_conf_content }}"
dest: "{{ nft_output_conf_path }}"
owner: root
group: root
mode: 0755
backup: "{{ nft_backup_conf }}"
notify: ['Reload nftables service']
when: nft_enabled|bool
2017-08-09 14:27:07 +02:00
- name: Filter table - generate forward rules file
template:
src: "{{ nft_forward_conf_content }}"
dest: "{{ nft_forward_conf_path }}"
owner: root
group: root
mode: 0755
backup: yes
notify: ['Reload nftables service']
when: (nft_enabled|bool and
nft__forward_table_manage|bool)
2019-04-16 15:48:30 +02:00
# Nat table content [[[1
- name: Nat table - generate prerouting rules file
template:
src: "{{ nft__nat_prerouting_conf_content }}"
dest: "{{ nft__nat_prerouting_conf_path }}"
owner: root
group: root
mode: 0755
backup: "{{ nft_backup_conf }}"
notify: ['Reload nftables service']
2019-04-16 15:48:30 +02:00
when: (nft_enabled|bool and
nft__nat_table_manage|bool)
- name: Nat table - generate postrouting rules file
template:
src: "{{ nft__nat_postrouting_conf_content }}"
dest: "{{ nft__nat_postrouting_conf_path }}"
owner: root
group: root
mode: 0755
backup: "{{ nft_backup_conf }}"
notify: ['Reload nftables service']
2019-04-16 15:48:30 +02:00
when: (nft_enabled|bool and
nft__nat_table_manage|bool)
# Manage service [[[1
- name: Install Debian systemd service unit
2018-02-06 16:58:18 +01:00
template:
src: '{{ nft_service_unit_content }}'
dest: '{{ nft_service_unit_path }}'
owner: 'root'
group: 'root'
mode: '0644'
register: nftables__register_systemd_service
when: (nft_enabled|bool and
nft_service_manage|bool)
notify: ['Restart nftables service']