60 lines
2.9 KiB
YAML
60 lines
2.9 KiB
YAML
---
|
|
- name: "Firewalld : Gather status"
|
|
when: agent_apply_firewalld_rule is defined and agent_apply_firewalld_rule in ["force", "auto"]
|
|
become: true
|
|
ansible.builtin.systemd:
|
|
name: firewalld
|
|
register: agent_register_firewalld_service
|
|
tags: [firewall, deploy]
|
|
|
|
- name: "DEBUG : Print service facts"
|
|
when: agent_apply_firewalld_rule is defined and agent_apply_firewalld_rule in ["force", "auto"]
|
|
ansible.builtin.debug:
|
|
msg: >
|
|
ActiveState: {{ agent_register_firewalld_service.status.ActiveState | default(False) }}
|
|
MainPID: {{ agent_register_firewalld_service.status.MainPID | default(False) }}
|
|
UnitState: {{ agent_register_firewalld_service.status.UnitFileState | default(False) }}
|
|
tags: [never, debug]
|
|
|
|
- name: "DEBUG : Print rich rule"
|
|
when: >-
|
|
agent_apply_firewalld_rule is defined and agent_apply_firewalld_rule in ["force", "auto"]
|
|
and agent_firewall_allow_from is defined
|
|
ansible.builtin.debug:
|
|
msg: '{{ "rule family=ipv" + agent_internal_ip_version | string + " source address=" + agent_firewall_allow_from | string + " port protocol=tcp port=" + agent_param_listenport
|
|
| string + " accept" if agent_firewall_allow_from is defined else omit }}'
|
|
tags: [never, debug]
|
|
vars:
|
|
agent_internal_ip_version: "{{ 6 if agent_firewall_allow_from is defined and agent_firewall_allow_from | ansible.utils.ipv6 else 4 }}"
|
|
|
|
- name: "Firewalld : Apply rule"
|
|
become: true
|
|
when: >
|
|
agent_apply_firewalld_rule is defined and agent_apply_firewalld_rule in ["force"]
|
|
or agent_apply_firewalld_rule is defined and agent_apply_firewalld_rule in ["auto"]
|
|
and (
|
|
agent_param_startagents is defined and agent_param_startagents | string != "0"
|
|
or agent_param_startagents is not defined
|
|
)
|
|
and (
|
|
(
|
|
agent_register_firewalld_service.status.ActiveState is defined
|
|
and agent_register_firewalld_service.status.ActiveState == "active"
|
|
)
|
|
or (
|
|
agent_register_firewalld_service.status.UnitFileState is defined
|
|
and agent_register_firewalld_service.status.UnitFileState == "enabled"
|
|
)
|
|
)
|
|
ansible.posix.firewalld:
|
|
port: '{{ agent_param_listenport | string + "/tcp" if agent_firewall_allow_from is not defined else omit }}'
|
|
rich_rule: '{{ "rule family=ipv" + agent_internal_ip_version | string + " source address=" + agent_firewall_allow_from | string + " port protocol=tcp port=" +
|
|
agent_param_listenport | string + " accept" if agent_firewall_allow_from is defined else omit }}'
|
|
zone: "{{ agent_firewalld_zone | default(omit) }}"
|
|
permanent: true
|
|
immediate: '{{ true if agent_register_firewalld_service.status.ActiveState == "active" else false }}'
|
|
state: enabled
|
|
vars:
|
|
agent_internal_ip_version: "{{ 6 if agent_firewall_allow_from is defined and agent_firewall_allow_from | ansible.utils.ipv6 else 4 }}"
|
|
tags: [firewall, deploy]
|