56 lines
1.7 KiB
YAML
Executable file
56 lines
1.7 KiB
YAML
Executable file
---
|
|
- name: Set gray interface (10.100.x.x)
|
|
ansible.builtin.set_fact:
|
|
interface_1: "{{ item.key }}"
|
|
update_firewall_interface_ip_1: "{{ item.value.ipv4.address }}"
|
|
loop: "{{ ansible_facts | dict2items }}"
|
|
when:
|
|
- item.value.ipv4 is defined
|
|
- item.value.ipv4.address is defined
|
|
- item.value.ipv4.address.startswith('10.100')
|
|
|
|
- name: Set white interface
|
|
ansible.builtin.set_fact:
|
|
interface_2: "{{ item.key }}"
|
|
update_firewall_interface_ip_2: "{{ item.value.ipv4.address }}"
|
|
loop: "{{ ansible_facts | dict2items }}"
|
|
when:
|
|
- item.value.ipv4 is defined
|
|
- item.value.ipv4.address is defined
|
|
- not item.value.ipv4.address.startswith('10.100')
|
|
- not item.value.ipv4.address.startswith('127.')
|
|
|
|
- name: Add firewall rules
|
|
ansible.builtin.template:
|
|
src: templates/nftables.conf.j2
|
|
dest: /etc/nftables.conf
|
|
mode: '0644'
|
|
owner: root
|
|
group: root
|
|
register: update_firewall_nftables_config
|
|
|
|
- name: Validate nftables configuration
|
|
ansible.builtin.command: nft -cnf /etc/nftables.conf
|
|
register: update_firewall_nftables_validation
|
|
failed_when: update_firewall_nftables_validation.rc != 0
|
|
when: update_firewall_nftables_config.changed
|
|
|
|
- name: Restart nftables
|
|
ansible.builtin.service:
|
|
name: nftables
|
|
state: restarted
|
|
when:
|
|
- update_firewall_nftables_config.changed
|
|
- update_firewall_nftables_validation.rc == 0
|
|
ignore_errors: "{{ ansible_check_mode }}"
|
|
|
|
- name: Restart Docker service
|
|
ansible.builtin.systemd:
|
|
name: docker
|
|
state: restarted
|
|
when:
|
|
- update_firewall_nftables_config.changed
|
|
- update_firewall_nftables_validation.rc == 0
|
|
- inventory_hostname is match("^PTAF")
|
|
ignore_errors: "{{ ansible_check_mode }}"
|
|
...
|