59 lines
1.6 KiB
YAML
59 lines
1.6 KiB
YAML
---
|
|
- name: ensure /etc/nftables.d exists
|
|
ansible.builtin.file:
|
|
path: /etc/nftables.d
|
|
state: directory
|
|
mode: "0755"
|
|
when: nftables_bootstrap_files | default(false)
|
|
|
|
- name: bootstrap empty config files
|
|
ansible.builtin.copy:
|
|
dest: "/etc/nftables.d/{{ item }}"
|
|
content: ""
|
|
force: false
|
|
mode: "0644"
|
|
loop:
|
|
- 10-sets.nft
|
|
- 20-sets.nft
|
|
- 30-nat.nft
|
|
- 40-filter.nft
|
|
- 50-proxy.nft
|
|
- 90-dstnat.nft
|
|
- 90-forward.nft
|
|
- 90-input.nft
|
|
- 90-output.nft
|
|
- 90-proxy-output.nft
|
|
- 90-proxy-prerouting.nft
|
|
when: nftables_bootstrap_files | default(false)
|
|
|
|
- name: deploy nftables rules
|
|
ansible.builtin.copy:
|
|
src: "{{ item }}"
|
|
dest: "/etc/nftables.d/{{ item | basename }}"
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
loop: "{{ query('ansible.builtin.fileglob', role_path + '/files/' + inventory_hostname + '/*.nft') }}"
|
|
notify: restart nftables
|
|
|
|
- name: render nftable rules
|
|
ansible.builtin.template:
|
|
src: "{{ item }}"
|
|
dest: "/etc/nftables.d/{{ item | basename | regex_replace('\\.j2$', '') }}"
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
loop: "{{ query('ansible.builtin.fileglob', role_path + '/templates/' + inventory_hostname + '/*.nft.j2') }}"
|
|
notify: restart nftables
|
|
|
|
- name: deploy nftables.conf
|
|
ansible.builtin.template:
|
|
src: "{{ item }}"
|
|
dest: "/etc/{{ item | basename | regex_replace('\\.j2$', '') }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
validate: "nft -c -f %s"
|
|
loop: "{{ query('ansible.builtin.fileglob', role_path + '/templates/' + inventory_hostname + '/*.conf.j2') }}"
|
|
notify: restart nftables
|