add nginx, sshd, ssl roles

roles/nftables/tasks/configure.yml

@@ -4,38 +4,55 @@
     path: /etc/nftables.d
     state: directory
     mode: "0755"
+  when: nftables_bootstrap_files | default(false)
 
-- name: deploy nftables rule
+- name: bootstrap empty config files
   ansible.builtin.copy:
-    src: "{{ item }}"
     dest: "/etc/nftables.d/{{ item }}"
+    content: ""
+    force: false
     mode: "0644"
   loop:
-    - 10-filter.nft
-    - 10-nat.nft
-    - 20-vpn.nft
-    - 30-proxy.nft
-    - 40-sets.nft
+    - 10-sets.nft
+    - 20-sets.nft
+    - 30-nat.nft
+    - 40-filter.nft
+    - 50-proxy.nft
+    - 90-dstnat.nft
+    - 90-forward.nft
+    - 90-input.nft
+    - 90-output.nft
+    - 90-proxy-output.nft
+    - 90-proxy-prerouting.nft
+  when: nftables_bootstrap_files | default(false)
+
+- name: deploy nftables rules
+  ansible.builtin.copy:
+    src: "{{ item }}"
+    dest: "/etc/nftables.d/{{ item | basename }}"
+    owner: root
+    group: root
+    mode: '0644'
+  loop: "{{ query('ansible.builtin.fileglob', role_path + '/files/' + inventory_hostname + '/*.nft') }}"
   notify: restart nftables
 
-- name: render forward
+- name: render nftable rules
   ansible.builtin.template:
-    src: 90-forward.nft.j2
-    dest: /etc/nftables.d/90-forward.nft
-    mode: "0644"
-  notify: restart nftables
-
-- name: render dstnat
-  ansible.builtin.template:
-    src: 90-dstnat.nft.j2
-    dest: /etc/nftables.d/90-dstnat.nft
-    mode: "0644"
+    src: "{{ item }}"
+    dest: "/etc/nftables.d/{{ item | basename | regex_replace('\\.j2$', '') }}"
+    owner: root
+    group: root
+    mode: '0644'
+  loop: "{{ query('ansible.builtin.fileglob', role_path + '/templates/' + inventory_hostname + '/*.nft.j2') }}"
   notify: restart nftables
 
 - name: deploy nftables.conf
-  ansible.builtin.copy:
-    src: nftables.conf
-    dest: /etc/nftables.conf
+  ansible.builtin.template:
+    src: "{{ item }}"
+    dest: "/etc/{{ item | basename | regex_replace('\\.j2$', '') }}"
+    owner: root
+    group: root
     mode: "0644"
     validate: "nft -c -f %s"
+  loop: "{{ query('ansible.builtin.fileglob', role_path + '/templates/' + inventory_hostname + '/*.conf.j2') }}"
   notify: restart nftables