From 4047d64c76138742fee9583a8c0a44c47a95e568 Mon Sep 17 00:00:00 2001
From: Gardouille <gardouille@gmail.com>
Date: Tue, 16 Apr 2019 11:50:30 +0200
Subject: [PATCH] =?UTF-8?q?Add=20a=20variable=20to=20manage=20custom=20con?=
 =?UTF-8?q?tent=20(table,=20include,=E2=80=A6)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 CHANGELOG.md                   | 3 ++-
 README.md                      | 3 ++-
 defaults/main.yml              | 5 +++++
 templates/etc/nftables.conf.j2 | 5 +++++
 4 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b135578..2caf1f6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,8 +1,9 @@
-## v1.X
+## v1.5.0
 
 ### Enhancements
 * Add a variable to disable "Protect" instructions in systemd unit.
 * Improve vars description/comments in default/main.yml.
+* Add a variable to manage custom content (table, include,…).
 
 ## v1.4.1
 
diff --git a/README.md b/README.md
index 975fefe..42dc319 100644
--- a/README.md
+++ b/README.md
@@ -38,7 +38,8 @@ Highly inspired by [Mike Gleason firewall role][mikegleasonjr firewall github] (
 * **nft_global_default_rules** : Set default rules for `global` chain. Other chains will jump to `global` before apply their specific rules.
 * **nft_global_rules** : You can add `global` rules or override those defined by **nft_global_default_rules** for all hosts.
 * **nft_global_group_rules** : You can add `global` rules or override those defined by **nft_global_default_rules** and **nft_global_rules** for a group.
-* **nft_global_host_rules:** : Hosts can also add or override all previours rules.
+* **nft_global_host_rules** : Hosts can also add or override all previours rules.
+* **nft__custom_content** : Custom content (tables, include,…) to add in Nftables configuration [default : `''`].
 * **nft_input_default_rules** : Set default rules for `input` chain.
 * **nft_input_rules** : You can add `input` rules or override those defined by **nft_input_default_rules** for all hosts.
 * **nft_input_group_rules** : You can add `input` rules or override those defined by **nft_input_default_rules** and **nft_input_rules** for a group.
diff --git a/defaults/main.yml b/defaults/main.yml
index 51e3d69..36aa9d3 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -66,6 +66,11 @@ nft_global_group_rules: {}
 # in the Ansible inventory.
 nft_global_host_rules: {}
                                                                    # ]]]
+# .. envvar:: nft__custom_content [[[
+#
+# Custom content (tables, include,…) to add in Nftables configuration.
+nft__custom_content: ''
+                                                                   # ]]]
                                                                    # ]]]
 # Nftables vars definition [[[
 # ----------------------------
diff --git a/templates/etc/nftables.conf.j2 b/templates/etc/nftables.conf.j2
index d034eae..c1e8929 100755
--- a/templates/etc/nftables.conf.j2
+++ b/templates/etc/nftables.conf.j2
@@ -26,3 +26,8 @@ table inet filter {
 	include "{{ nft_input_conf_path }}"
 	include "{{ nft_output_conf_path }}"
 }
+
+{% if nft__custom_content|d() %}
+# Custom content from ipr-cnrs.nftables
+{{ nft__custom_content }}
+{% endif %}