39 lines
999 B
YAML
39 lines
999 B
YAML
---
|
|
# firewalld and a hand-written nftables.service ruleset can't coexist: our
|
|
# `flush ruleset` wipes firewalld's tables, and a firewalld reload wipes ours.
|
|
- name: Gather service facts
|
|
ansible.builtin.service_facts:
|
|
|
|
- name: Stop and mask firewalld
|
|
ansible.builtin.systemd:
|
|
name: firewalld.service
|
|
state: stopped
|
|
enabled: false
|
|
masked: true
|
|
when: "'firewalld.service' in ansible_facts.services"
|
|
|
|
- name: Install nftables base ruleset
|
|
ansible.builtin.template:
|
|
src: main.nft.j2
|
|
dest: /etc/nftables/main.nft
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
validate: "nft -c -f %s"
|
|
notify: restart nftables
|
|
|
|
- name: Point nftables.service at our ruleset
|
|
ansible.builtin.copy:
|
|
dest: /etc/sysconfig/nftables.conf
|
|
content: "include \"/etc/nftables/main.nft\"\n"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: restart nftables
|
|
|
|
- name: Enable nftables
|
|
ansible.builtin.systemd:
|
|
name: nftables.service
|
|
enabled: true
|
|
state: started
|