Set a variable to enable/disable Nftables

This commit is contained in:
Jeremy Gardais 2018-05-16 14:38:33 +02:00
parent 0a909641b5
commit bf9080fcb3
Signed by: jegardai
GPG Key ID: E759BAA22501AF32
4 changed files with 37 additions and 8 deletions

View File

@ -1,3 +1,7 @@
## v1.X
### Enhancements
* Set a variable to enable/disable the support of Nftables.
## v1.3.1 ## v1.3.1

View File

@ -19,7 +19,7 @@ Highly inspired by [Mike Gleason firewall role][mikegleasonjr firewall github] (
## Role Variables ## Role Variables
* **nft_pkg_manage**: If `nftables` package(s) should be managed with this role [default: `true`]. * **nft_enabled**: Enable or disable support for Nftables [default: `true`].
* **nft_pkg_state**: State of new `nftables` package(s) [default: `installed`]. * **nft_pkg_state**: State of new `nftables` package(s) [default: `installed`].
* **nft_old_pkg_list**: The list of useless packages to remove (such as Iptables,…) [default: `iptables`]. * **nft_old_pkg_list**: The list of useless packages to remove (such as Iptables,…) [default: `iptables`].
* **nft_old_pkg_state**: State of old package(s) [default: `absent`]. * **nft_old_pkg_state**: State of old package(s) [default: `absent`].

View File

@ -1,8 +1,22 @@
--- ---
# defaults file for nftables # .. vim: foldmarker=[[[,]]]:foldmethod=marker
#
# ipr-cnrs.nftables default variables [[[
# =======================================
# Packages and installation [[[
# -----------------------------
# .. envvar:: nft_enabled [[[
#
# Enable or disable support for Nftables on a given host. Disabling this
# option does not remove existing installation and configuration.
#
nft_enabled: true
# ]]]
# packages # packages
nft_pkg_manage: true
nft_pkg_state: 'installed' nft_pkg_state: 'installed'
nft_old_pkg_list: 'iptables' nft_old_pkg_list: 'iptables'
nft_old_pkg_state: 'absent' nft_old_pkg_state: 'absent'
@ -21,6 +35,7 @@ nft_define_conf_content: 'etc/nftables.d/defines.nft.j2'
nft_set_conf_path: '{{ nft_conf_dir_path }}/sets.nft' nft_set_conf_path: '{{ nft_conf_dir_path }}/sets.nft'
nft_set_conf_content: 'etc/nftables.d/sets.nft.j2' nft_set_conf_content: 'etc/nftables.d/sets.nft.j2'
# ]]]
# rules # rules
nft_global_default_rules: nft_global_default_rules:
005 state management: 005 state management:

View File

@ -15,7 +15,7 @@
state: '{{ nft_pkg_state }}' state: '{{ nft_pkg_state }}'
with_items: with_items:
- '{{ nft_pkg_list }}' - '{{ nft_pkg_list }}'
when: nft_pkg_manage when: nft_enabled|bool
- name: INSTALL Remove iptables packages - name: INSTALL Remove iptables packages
apt: apt:
@ -23,7 +23,9 @@
state: '{{ nft_old_pkg_state }}' state: '{{ nft_old_pkg_state }}'
with_items: with_items:
- '{{ nft_old_pkg_list }}' - '{{ nft_old_pkg_list }}'
when: nft_old_pkg_manage when: (nft_enabled|bool and
nft_old_pkg_manage|bool)
# }}} # }}}
# conf {{{ # conf {{{
@ -32,6 +34,7 @@
path: "{{ nft_conf_dir_path }}" path: "{{ nft_conf_dir_path }}"
state: directory state: directory
mode: 0755 mode: 0755
when: nft_enabled|bool
- name: CONFIG generate main conf file - name: CONFIG generate main conf file
template: template:
@ -42,6 +45,7 @@
mode: 0755 mode: 0755
backup: yes backup: yes
notify: ['restart nftables service'] notify: ['restart nftables service']
when: nft_enabled|bool
- name: CONFIG generate input rules file - name: CONFIG generate input rules file
template: template:
@ -52,6 +56,7 @@
mode: 0755 mode: 0755
backup: yes backup: yes
notify: ['restart nftables service'] notify: ['restart nftables service']
when: nft_enabled|bool
- name: CONFIG generate output rules file - name: CONFIG generate output rules file
template: template:
@ -62,6 +67,7 @@
mode: 0755 mode: 0755
backup: yes backup: yes
notify: ['restart nftables service'] notify: ['restart nftables service']
when: nft_enabled|bool
- name: CONFIG generate vars definition file - name: CONFIG generate vars definition file
template: template:
@ -72,6 +78,7 @@
mode: 0755 mode: 0755
backup: yes backup: yes
notify: ['restart nftables service'] notify: ['restart nftables service']
when: nft_enabled|bool
- name: CONFIG generate sets and maps file - name: CONFIG generate sets and maps file
template: template:
@ -82,6 +89,7 @@
mode: 0755 mode: 0755
backup: yes backup: yes
notify: ['restart nftables service'] notify: ['restart nftables service']
when: nft_enabled|bool
# }}} # }}}
# service {{{ # service {{{
@ -94,13 +102,14 @@
group: 'root' group: 'root'
mode: '0644' mode: '0644'
register: nftables__register_systemd_service register: nftables__register_systemd_service
when: nft_service_manage when: (nft_enabled|bool and
nft_service_manage|bool)
notify: ['restart nftables service'] notify: ['restart nftables service']
- name: Reload systemd daemons - name: Reload systemd daemons
command: systemctl daemon-reload command: systemctl daemon-reload
notify: ['restart nftables service'] notify: ['restart nftables service']
when: (nft_service_manage and when: (nft_service_manage|bool and
nftables__register_systemd_service|changed) nftables__register_systemd_service|changed)
- name: SERVICE manage '{{ nft_service_name }}' - name: SERVICE manage '{{ nft_service_name }}'
@ -108,5 +117,6 @@
name: '{{ nft_service_name }}' name: '{{ nft_service_name }}'
state: started state: started
enabled: '{{ nft_service_enabled }}' enabled: '{{ nft_service_enabled }}'
when: nft_service_manage when: (nft_enabled|bool and
nft_service_manage|bool)
# }}} # }}}