Generate main configuration file.
This commit is contained in:
parent
df57dc8042
commit
bc6f69fc59
|
@ -17,6 +17,8 @@ A role to manage Nftables rules and packages.
|
||||||
|
|
||||||
* **nft_pkg_manage** : If `nftables` package(s) should be managed with this role [default : `true`].
|
* **nft_pkg_manage** : If `nftables` package(s) should be managed with this role [default : `true`].
|
||||||
* **nft_pkg_state** : State of new `nftables` package(s) [default : `installed`].
|
* **nft_pkg_state** : State of new `nftables` package(s) [default : `installed`].
|
||||||
|
* **nft_main_conf_path** : Main configuration file loaded by systemd unit [default : `/etc/nftables.conf`].
|
||||||
|
* **nft_main_conf_content** : Template used to generate the previous main configuration file [default : `etc/nftables.conf.j2`].
|
||||||
|
|
||||||
### OS Specific Variables
|
### OS Specific Variables
|
||||||
|
|
||||||
|
@ -38,6 +40,7 @@ Please see default value by Operating System file in [vars][vars directory] dire
|
||||||
|
|
||||||
This role will :
|
This role will :
|
||||||
* Install `nftables` on the system.
|
* Install `nftables` on the system.
|
||||||
|
* Generate a default configuration file loaded by systemd unit.
|
||||||
|
|
||||||
## Development
|
## Development
|
||||||
|
|
||||||
|
|
|
@ -2,5 +2,9 @@
|
||||||
# defaults file for nftables
|
# defaults file for nftables
|
||||||
|
|
||||||
# packages
|
# packages
|
||||||
nft_pkg_manage: true
|
nft_pkg_manage: true
|
||||||
nft_pkg_state: 'installed'
|
nft_pkg_state: 'installed'
|
||||||
|
|
||||||
|
# conf
|
||||||
|
nft_main_conf_path: '/etc/nftables.conf'
|
||||||
|
nft_main_conf_content: 'etc/nftables.conf.j2'
|
||||||
|
|
|
@ -8,6 +8,7 @@
|
||||||
- "{{ ansible_distribution|lower }}.yml"
|
- "{{ ansible_distribution|lower }}.yml"
|
||||||
- "{{ ansible_os_family|lower }}.yml"
|
- "{{ ansible_os_family|lower }}.yml"
|
||||||
|
|
||||||
|
# package {{{
|
||||||
- name: Manage packages
|
- name: Manage packages
|
||||||
package:
|
package:
|
||||||
name: '{{ item }}'
|
name: '{{ item }}'
|
||||||
|
@ -16,3 +17,16 @@
|
||||||
- '{{ nft_pkg_list }}'
|
- '{{ nft_pkg_list }}'
|
||||||
when: nft_pkg_manage
|
when: nft_pkg_manage
|
||||||
|
|
||||||
|
# }}}
|
||||||
|
|
||||||
|
# conf {{{
|
||||||
|
- name: generate main conf file
|
||||||
|
template:
|
||||||
|
src: "{{ nft_main_conf_content }}"
|
||||||
|
dest: "{{ nft_main_conf_path }}"
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: 0755
|
||||||
|
backup: yes
|
||||||
|
|
||||||
|
# }}}
|
||||||
|
|
|
@ -0,0 +1,14 @@
|
||||||
|
#!/usr/sbin/nft -f
|
||||||
|
# {{ ansible_managed }}
|
||||||
|
|
||||||
|
# clean
|
||||||
|
flush ruleset
|
||||||
|
|
||||||
|
table inet firewall {
|
||||||
|
chain input {
|
||||||
|
type filter hook input priority 0;
|
||||||
|
}
|
||||||
|
chain output {
|
||||||
|
type filter hook output priority 0;
|
||||||
|
}
|
||||||
|
}
|
Loading…
Reference in New Issue