---
- name: Set gray interface (10.100.x.x)
  ansible.builtin.set_fact:
    interface_1: "{{ item.key }}"
    update_firewall_interface_ip_1: "{{ item.value.ipv4.address }}"
  loop: "{{ ansible_facts | dict2items }}"
  when:
    - item.value.ipv4 is defined
    - item.value.ipv4.address is defined
    - item.value.ipv4.address.startswith('10.100')

- name: Set white interface
  ansible.builtin.set_fact:
    interface_2: "{{ item.key }}"
    update_firewall_interface_ip_2: "{{ item.value.ipv4.address }}"
  loop: "{{ ansible_facts | dict2items }}"
  when:
    - item.value.ipv4 is defined
    - item.value.ipv4.address is defined
    - not item.value.ipv4.address.startswith('10.100')
    - not item.value.ipv4.address.startswith('127.')

- name: Add firewall rules
  ansible.builtin.template:
    src: templates/nftables.conf.j2
    dest: /etc/nftables.conf
    mode: '0644'
    owner: root
    group: root
  register: update_firewall_nftables_config

- name: Validate nftables configuration
  ansible.builtin.command: nft -cnf /etc/nftables.conf
  register: update_firewall_nftables_validation
  failed_when: update_firewall_nftables_validation.rc != 0
  when: update_firewall_nftables_config.changed

- name: Restart nftables
  ansible.builtin.service:
    name: nftables
    state: restarted
  when:
    - update_firewall_nftables_config.changed
    - update_firewall_nftables_validation.rc == 0
  ignore_errors: "{{ ansible_check_mode }}"

- name: Restart Docker service
  ansible.builtin.systemd:
    name: docker
    state: restarted
  when:
    - update_firewall_nftables_config.changed
    - update_firewall_nftables_validation.rc == 0
    - inventory_hostname is match("^PTAF")
  ignore_errors: "{{ ansible_check_mode }}"
...