diff --git a/.ansible-lint b/.ansible-lint new file mode 100644 index 0000000..6a84406 --- /dev/null +++ b/.ansible-lint @@ -0,0 +1,4 @@ +skip_list: + - command-instead-of-module + - no-changed-when + - role-name \ No newline at end of file diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index f8b2338..c696e54 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -1,20 +1,23 @@ --- -name: Molecule +name: ipr-cnrs.nftables.molecule on: push: - branches: [main] + branches: [master] pull_request: - branches: [main] + branches: [master] workflow_dispatch: jobs: - build: - runs-on: ubuntu-latest - + test: + runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 - - name: Ansible Molecule - uses: MonolithProjects/action-molecule@v1.4.3 + - name: checkout + uses: actions/checkout@v2 + with: + path: "${{ github.repository }}" + + - name: molecule + uses: robertdebock/molecule-action@2.6.17 \ No newline at end of file diff --git a/meta/main.yml b/meta/main.yml index 0ffdc2f..147c452 100644 --- a/meta/main.yml +++ b/meta/main.yml @@ -4,6 +4,8 @@ dependencies: [] galaxy_info: author: "Jérémy Gardais" + namespace: ipr-cnrs + role_name: nftables description: "Manage Nftables rules and packages" license: WTFPL company: IPR diff --git a/molecule/archlinux/Dockerfile.j2 b/molecule/archlinux/Dockerfile.j2 new file mode 100644 index 0000000..4c583c0 --- /dev/null +++ b/molecule/archlinux/Dockerfile.j2 @@ -0,0 +1,7 @@ +FROM archlinux:latest +ENV container=docker + +RUN pacman -Sy --noconfirm python + +VOLUME ["/sys/fs/cgroup", "/tmp", "/run"] +CMD ["/usr/sbin/init"] \ No newline at end of file diff --git a/molecule/archlinux/converge.yml b/molecule/archlinux/converge.yml new file mode 100644 index 0000000..40473ca --- /dev/null +++ b/molecule/archlinux/converge.yml @@ -0,0 +1,9 @@ +--- +- name: Converge + hosts: all + gather_facts: yes + roles: + - role: ipr-cnrs.nftables + nft_debug: true + # can't remove iptables on an instance with docker + nft_old_pkg_manage: false \ No newline at end of file diff --git a/molecule/archlinux/molecule.yml b/molecule/archlinux/molecule.yml new file mode 100644 index 0000000..893931b --- /dev/null +++ b/molecule/archlinux/molecule.yml @@ -0,0 +1,19 @@ +--- +dependency: + name: galaxy +driver: + name: docker +platforms: + - name: archlinux + image: archlinux:latest + command: /usr/sbin/init + privileged: true + volumes: + - /sys/fs/cgroup:/sys/fs/cgroup:ro + tmpfs: + - /run + - /tmp +provisioner: + name: ansible +verifier: + name: ansible diff --git a/molecule/archlinux/verify.yml b/molecule/archlinux/verify.yml new file mode 100644 index 0000000..3ac7ebe --- /dev/null +++ b/molecule/archlinux/verify.yml @@ -0,0 +1,72 @@ +--- +# This is an example playbook to execute Ansible tests. + +- name: Verify + hosts: all + gather_facts: false + tasks: + + - name: check for nftables.d + stat: + path: /etc/nftables.d + register: p + + - name: check nftables.d + assert: + that: + - p.stat.exists and p.stat.isdir + + - name: check for nftables.conf + stat: + path: /etc/nftables.conf + register: p + + - name: check nftables.conf + assert: + that: + - p.stat.exists + + - name: check for nftables.conf + stat: + path: /etc/nftables.d/filter-input.nft + register: p + + - name: check filter-input.nft + assert: + that: + - p.stat.exists + + - name: list rules + command: nft list ruleset + register: nft + + - name: debug rules + debug: var=nft + + - name: check rules + assert: + that: + # The whole line is: + # type filter hook input priority 0; policy drop; + # However on CentOS will return "priority 0", while Debian will + # show "priority filter" + - '"type filter hook input" in nft.stdout' + - '"type filter hook output" in nft.stdout' + + - name: service status - active + command: systemctl is-active nftables.service + register: status + + - name: check service status + assert: + that: + - 'status.stdout == "active"' + + - name: service status - enabled + command: systemctl is-enabled nftables.service + register: status + + - name: check service status + assert: + that: + - 'status.stdout == "enabled"' diff --git a/molecule/default/converge.yml b/molecule/default/converge.yml index 969a7b9..40473ca 100644 --- a/molecule/default/converge.yml +++ b/molecule/default/converge.yml @@ -1,7 +1,9 @@ --- - name: Converge hosts: all + gather_facts: yes roles: - role: ipr-cnrs.nftables - - + nft_debug: true + # can't remove iptables on an instance with docker + nft_old_pkg_manage: false \ No newline at end of file diff --git a/molecule/default/molecule.yml b/molecule/default/molecule.yml index 9bf46e9..6921c7f 100644 --- a/molecule/default/molecule.yml +++ b/molecule/default/molecule.yml @@ -1,11 +1,54 @@ --- dependency: name: galaxy +lint: | + set -e + yamllint . + ansible-lint driver: name: docker platforms: - - name: instance - image: ubuntu:latest + + - name: systemd-ubuntu-latest + image: jrei/systemd-ubuntu:latest + command: /usr/sbin/init + privileged: true + volumes: + - /sys/fs/cgroup:/sys/fs/cgroup:ro + tmpfs: + - /run + - /tmp + + - name: systemd-centos-latest + image: centos/systemd:latest + command: /usr/sbin/init + privileged: true + volumes: + - /sys/fs/cgroup:/sys/fs/cgroup:ro + tmpfs: + - /run + - /tmp + + - name: systemd-debian-latest + image: jrei/systemd-debian:latest + command: /sbin/init + privileged: true + volumes: + - /sys/fs/cgroup:/sys/fs/cgroup:ro + tmpfs: + - /run + - /tmp + + - name: systemd-fedora-latest + image: jrei/systemd-fedora:latest + command: /usr/sbin/init + privileged: true + volumes: + - /sys/fs/cgroup:/sys/fs/cgroup:ro + tmpfs: + - /run + - /tmp + provisioner: name: ansible verifier: diff --git a/molecule/default/verify.yml b/molecule/default/verify.yml index 79044cd..3ac7ebe 100644 --- a/molecule/default/verify.yml +++ b/molecule/default/verify.yml @@ -5,6 +5,68 @@ hosts: all gather_facts: false tasks: - - name: Example assertion + + - name: check for nftables.d + stat: + path: /etc/nftables.d + register: p + + - name: check nftables.d assert: - that: true + that: + - p.stat.exists and p.stat.isdir + + - name: check for nftables.conf + stat: + path: /etc/nftables.conf + register: p + + - name: check nftables.conf + assert: + that: + - p.stat.exists + + - name: check for nftables.conf + stat: + path: /etc/nftables.d/filter-input.nft + register: p + + - name: check filter-input.nft + assert: + that: + - p.stat.exists + + - name: list rules + command: nft list ruleset + register: nft + + - name: debug rules + debug: var=nft + + - name: check rules + assert: + that: + # The whole line is: + # type filter hook input priority 0; policy drop; + # However on CentOS will return "priority 0", while Debian will + # show "priority filter" + - '"type filter hook input" in nft.stdout' + - '"type filter hook output" in nft.stdout' + + - name: service status - active + command: systemctl is-active nftables.service + register: status + + - name: check service status + assert: + that: + - 'status.stdout == "active"' + + - name: service status - enabled + command: systemctl is-enabled nftables.service + register: status + + - name: check service status + assert: + that: + - 'status.stdout == "enabled"' diff --git a/tasks/main.yml b/tasks/main.yml index 8ca5b37..3746cc7 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -13,7 +13,8 @@ loop_control: loop_var: groupname -- debug: var=nftables_group_rules +- name: Debug nftables_group_rules + debug: var=nftables_group_rules when: nft_debug - name: Import nftables-variables if nft_merged_groups is set @@ -36,7 +37,12 @@ loop_control: loop_var: varfile -- debug: var=nft_combined_rules +- name: Debug nft_combined_rules + debug: var=nft_combined_rules + when: nft_debug + +- name: Debug ansible_os_family + debug: var=ansible_os_family when: nft_debug - name: Load specific OS vars for nftables @@ -53,6 +59,7 @@ package: name: '{{ nft_pkg_list | list }}' state: '{{ nft_pkg_state }}' + update_cache: true register: pkg_install_result until: pkg_install_result is success when: nft_enabled|bool @@ -178,5 +185,4 @@ register: nftables__register_systemd_service when: (nft_enabled|bool and nft_service_manage|bool) - notify: ['Restart nftables service'] - + notify: ['Restart nftables service'] \ No newline at end of file diff --git a/vars/alpine.yml b/vars/alpine.yml new file mode 100644 index 0000000..f015e96 --- /dev/null +++ b/vars/alpine.yml @@ -0,0 +1,4 @@ +--- +# vars file for Alpine +nft_pkg_list: + - nftables \ No newline at end of file diff --git a/vars/archlinux.yml b/vars/archlinux.yml new file mode 100644 index 0000000..4218564 --- /dev/null +++ b/vars/archlinux.yml @@ -0,0 +1,4 @@ +--- +# vars file for Archlinux-based distros +nft_pkg_list: + - nftables \ No newline at end of file diff --git a/vars/centos.yml b/vars/redhat.yml similarity index 100% rename from vars/centos.yml rename to vars/redhat.yml