Set a variable to enable/disable Nftables
This commit is contained in:
parent
0a909641b5
commit
bf9080fcb3
|
@ -1,3 +1,7 @@
|
||||||
|
## v1.X
|
||||||
|
|
||||||
|
### Enhancements
|
||||||
|
* Set a variable to enable/disable the support of Nftables.
|
||||||
|
|
||||||
## v1.3.1
|
## v1.3.1
|
||||||
|
|
||||||
|
|
|
@ -19,7 +19,7 @@ Highly inspired by [Mike Gleason firewall role][mikegleasonjr firewall github] (
|
||||||
|
|
||||||
## Role Variables
|
## Role Variables
|
||||||
|
|
||||||
* **nft_pkg_manage** : If `nftables` package(s) should be managed with this role [default : `true`].
|
* **nft_enabled** : Enable or disable support for Nftables [default : `true`].
|
||||||
* **nft_pkg_state** : State of new `nftables` package(s) [default : `installed`].
|
* **nft_pkg_state** : State of new `nftables` package(s) [default : `installed`].
|
||||||
* **nft_old_pkg_list** : The list of useless packages to remove (such as Iptables,…) [default : `iptables`].
|
* **nft_old_pkg_list** : The list of useless packages to remove (such as Iptables,…) [default : `iptables`].
|
||||||
* **nft_old_pkg_state** : State of old package(s) [default : `absent`].
|
* **nft_old_pkg_state** : State of old package(s) [default : `absent`].
|
||||||
|
|
|
@ -1,8 +1,22 @@
|
||||||
---
|
---
|
||||||
# defaults file for nftables
|
# .. vim: foldmarker=[[[,]]]:foldmethod=marker
|
||||||
|
#
|
||||||
|
# ipr-cnrs.nftables default variables [[[
|
||||||
|
# =======================================
|
||||||
|
|
||||||
|
# Packages and installation [[[
|
||||||
|
# -----------------------------
|
||||||
|
|
||||||
|
# .. envvar:: nft_enabled [[[
|
||||||
|
#
|
||||||
|
# Enable or disable support for Nftables on a given host. Disabling this
|
||||||
|
# option does not remove existing installation and configuration.
|
||||||
|
#
|
||||||
|
nft_enabled: true
|
||||||
|
|
||||||
|
# ]]]
|
||||||
|
|
||||||
# packages
|
# packages
|
||||||
nft_pkg_manage: true
|
|
||||||
nft_pkg_state: 'installed'
|
nft_pkg_state: 'installed'
|
||||||
nft_old_pkg_list: 'iptables'
|
nft_old_pkg_list: 'iptables'
|
||||||
nft_old_pkg_state: 'absent'
|
nft_old_pkg_state: 'absent'
|
||||||
|
@ -21,6 +35,7 @@ nft_define_conf_content: 'etc/nftables.d/defines.nft.j2'
|
||||||
nft_set_conf_path: '{{ nft_conf_dir_path }}/sets.nft'
|
nft_set_conf_path: '{{ nft_conf_dir_path }}/sets.nft'
|
||||||
nft_set_conf_content: 'etc/nftables.d/sets.nft.j2'
|
nft_set_conf_content: 'etc/nftables.d/sets.nft.j2'
|
||||||
|
|
||||||
|
# ]]]
|
||||||
# rules
|
# rules
|
||||||
nft_global_default_rules:
|
nft_global_default_rules:
|
||||||
005 state management:
|
005 state management:
|
||||||
|
|
|
@ -15,7 +15,7 @@
|
||||||
state: '{{ nft_pkg_state }}'
|
state: '{{ nft_pkg_state }}'
|
||||||
with_items:
|
with_items:
|
||||||
- '{{ nft_pkg_list }}'
|
- '{{ nft_pkg_list }}'
|
||||||
when: nft_pkg_manage
|
when: nft_enabled|bool
|
||||||
|
|
||||||
- name: INSTALL Remove iptables packages
|
- name: INSTALL Remove iptables packages
|
||||||
apt:
|
apt:
|
||||||
|
@ -23,7 +23,9 @@
|
||||||
state: '{{ nft_old_pkg_state }}'
|
state: '{{ nft_old_pkg_state }}'
|
||||||
with_items:
|
with_items:
|
||||||
- '{{ nft_old_pkg_list }}'
|
- '{{ nft_old_pkg_list }}'
|
||||||
when: nft_old_pkg_manage
|
when: (nft_enabled|bool and
|
||||||
|
nft_old_pkg_manage|bool)
|
||||||
|
|
||||||
# }}}
|
# }}}
|
||||||
|
|
||||||
# conf {{{
|
# conf {{{
|
||||||
|
@ -32,6 +34,7 @@
|
||||||
path: "{{ nft_conf_dir_path }}"
|
path: "{{ nft_conf_dir_path }}"
|
||||||
state: directory
|
state: directory
|
||||||
mode: 0755
|
mode: 0755
|
||||||
|
when: nft_enabled|bool
|
||||||
|
|
||||||
- name: CONFIG generate main conf file
|
- name: CONFIG generate main conf file
|
||||||
template:
|
template:
|
||||||
|
@ -42,6 +45,7 @@
|
||||||
mode: 0755
|
mode: 0755
|
||||||
backup: yes
|
backup: yes
|
||||||
notify: ['restart nftables service']
|
notify: ['restart nftables service']
|
||||||
|
when: nft_enabled|bool
|
||||||
|
|
||||||
- name: CONFIG generate input rules file
|
- name: CONFIG generate input rules file
|
||||||
template:
|
template:
|
||||||
|
@ -52,6 +56,7 @@
|
||||||
mode: 0755
|
mode: 0755
|
||||||
backup: yes
|
backup: yes
|
||||||
notify: ['restart nftables service']
|
notify: ['restart nftables service']
|
||||||
|
when: nft_enabled|bool
|
||||||
|
|
||||||
- name: CONFIG generate output rules file
|
- name: CONFIG generate output rules file
|
||||||
template:
|
template:
|
||||||
|
@ -62,6 +67,7 @@
|
||||||
mode: 0755
|
mode: 0755
|
||||||
backup: yes
|
backup: yes
|
||||||
notify: ['restart nftables service']
|
notify: ['restart nftables service']
|
||||||
|
when: nft_enabled|bool
|
||||||
|
|
||||||
- name: CONFIG generate vars definition file
|
- name: CONFIG generate vars definition file
|
||||||
template:
|
template:
|
||||||
|
@ -72,6 +78,7 @@
|
||||||
mode: 0755
|
mode: 0755
|
||||||
backup: yes
|
backup: yes
|
||||||
notify: ['restart nftables service']
|
notify: ['restart nftables service']
|
||||||
|
when: nft_enabled|bool
|
||||||
|
|
||||||
- name: CONFIG generate sets and maps file
|
- name: CONFIG generate sets and maps file
|
||||||
template:
|
template:
|
||||||
|
@ -82,6 +89,7 @@
|
||||||
mode: 0755
|
mode: 0755
|
||||||
backup: yes
|
backup: yes
|
||||||
notify: ['restart nftables service']
|
notify: ['restart nftables service']
|
||||||
|
when: nft_enabled|bool
|
||||||
# }}}
|
# }}}
|
||||||
|
|
||||||
# service {{{
|
# service {{{
|
||||||
|
@ -94,13 +102,14 @@
|
||||||
group: 'root'
|
group: 'root'
|
||||||
mode: '0644'
|
mode: '0644'
|
||||||
register: nftables__register_systemd_service
|
register: nftables__register_systemd_service
|
||||||
when: nft_service_manage
|
when: (nft_enabled|bool and
|
||||||
|
nft_service_manage|bool)
|
||||||
notify: ['restart nftables service']
|
notify: ['restart nftables service']
|
||||||
|
|
||||||
- name: Reload systemd daemons
|
- name: Reload systemd daemons
|
||||||
command: systemctl daemon-reload
|
command: systemctl daemon-reload
|
||||||
notify: ['restart nftables service']
|
notify: ['restart nftables service']
|
||||||
when: (nft_service_manage and
|
when: (nft_service_manage|bool and
|
||||||
nftables__register_systemd_service|changed)
|
nftables__register_systemd_service|changed)
|
||||||
|
|
||||||
- name: SERVICE manage '{{ nft_service_name }}'
|
- name: SERVICE manage '{{ nft_service_name }}'
|
||||||
|
@ -108,5 +117,6 @@
|
||||||
name: '{{ nft_service_name }}'
|
name: '{{ nft_service_name }}'
|
||||||
state: started
|
state: started
|
||||||
enabled: '{{ nft_service_enabled }}'
|
enabled: '{{ nft_service_enabled }}'
|
||||||
when: nft_service_manage
|
when: (nft_enabled|bool and
|
||||||
|
nft_service_manage|bool)
|
||||||
# }}}
|
# }}}
|
||||||
|
|
Loading…
Reference in New Issue