diff --git a/CHANGELOG.md b/CHANGELOG.md index b135578..2caf1f6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,8 +1,9 @@ -## v1.X +## v1.5.0 ### Enhancements * Add a variable to disable "Protect" instructions in systemd unit. * Improve vars description/comments in default/main.yml. +* Add a variable to manage custom content (table, include,…). ## v1.4.1 diff --git a/README.md b/README.md index 975fefe..42dc319 100644 --- a/README.md +++ b/README.md @@ -38,7 +38,8 @@ Highly inspired by [Mike Gleason firewall role][mikegleasonjr firewall github] ( * **nft_global_default_rules** : Set default rules for `global` chain. Other chains will jump to `global` before apply their specific rules. * **nft_global_rules** : You can add `global` rules or override those defined by **nft_global_default_rules** for all hosts. * **nft_global_group_rules** : You can add `global` rules or override those defined by **nft_global_default_rules** and **nft_global_rules** for a group. -* **nft_global_host_rules:** : Hosts can also add or override all previours rules. +* **nft_global_host_rules** : Hosts can also add or override all previours rules. +* **nft__custom_content** : Custom content (tables, include,…) to add in Nftables configuration [default : `''`]. * **nft_input_default_rules** : Set default rules for `input` chain. * **nft_input_rules** : You can add `input` rules or override those defined by **nft_input_default_rules** for all hosts. * **nft_input_group_rules** : You can add `input` rules or override those defined by **nft_input_default_rules** and **nft_input_rules** for a group. diff --git a/defaults/main.yml b/defaults/main.yml index 51e3d69..36aa9d3 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -66,6 +66,11 @@ nft_global_group_rules: {} # in the Ansible inventory. nft_global_host_rules: {} # ]]] +# .. envvar:: nft__custom_content [[[ +# +# Custom content (tables, include,…) to add in Nftables configuration. +nft__custom_content: '' + # ]]] # ]]] # Nftables vars definition [[[ # ---------------------------- diff --git a/templates/etc/nftables.conf.j2 b/templates/etc/nftables.conf.j2 index d034eae..c1e8929 100755 --- a/templates/etc/nftables.conf.j2 +++ b/templates/etc/nftables.conf.j2 @@ -26,3 +26,8 @@ table inet filter { include "{{ nft_input_conf_path }}" include "{{ nft_output_conf_path }}" } + +{% if nft__custom_content|d() %} +# Custom content from ipr-cnrs.nftables +{{ nft__custom_content }} +{% endif %}