96 lines
4 KiB
YAML
96 lines
4 KiB
YAML
---
|
|
- name: Set platform/version specific variables
|
|
ansible.builtin.include_tasks: set_vars.yml
|
|
- name: Setup firewalld
|
|
ansible.builtin.include_tasks: firewalld.yml
|
|
- name: Check which conflicting services are enabled
|
|
# noqa command-instead-of-module
|
|
ansible.builtin.command: systemctl is-enabled "{{ item }}"
|
|
register: __firewall_conflicting_services_status
|
|
changed_when: false
|
|
failed_when: false
|
|
loop: "{{ __firewall_conflicting_services }}"
|
|
when: firewall_disable_conflicting_services | bool
|
|
check_mode: "{{ __firewall_test_check_mode | d(ansible_check_mode) }}"
|
|
|
|
- name: Attempt to stop and disable conflicting services
|
|
ansible.builtin.service:
|
|
name: "{{ item.item }}"
|
|
state: "{{ 'stopped' if __firewall_is_booted else omit }}"
|
|
enabled: false
|
|
loop: "{{ __firewall_conflicting_services_status.results }}"
|
|
check_mode: "{{ __firewall_test_check_mode | d(ansible_check_mode) }}"
|
|
when:
|
|
- firewall_disable_conflicting_services | bool
|
|
- item.rc == 0
|
|
|
|
- name: Unmask firewalld service
|
|
ansible.builtin.systemd:
|
|
name: "{{ __firewall_service }}"
|
|
masked: false
|
|
check_mode: "{{ __firewall_test_check_mode | d(ansible_check_mode) }}"
|
|
when: ansible_facts["service_mgr"] == "systemd"
|
|
|
|
- name: Enable and start firewalld service
|
|
ansible.builtin.service:
|
|
name: "{{ __firewall_service }}"
|
|
enabled: true
|
|
state: "{{ 'started' if __firewall_is_booted else omit }}"
|
|
check_mode: "{{ __firewall_test_check_mode | d(ansible_check_mode) }}"
|
|
|
|
# NOTE: The old implementation of this role would always set permanent to True if it was not set,
|
|
# and would set runtime to True if it was not set
|
|
# so replicate that behavior here in order to maintain backwards compatibility in the module
|
|
# in case someone is erroneously using the module directly
|
|
- name: Configure firewall and/or gather facts
|
|
vars:
|
|
firewall_config_list: "{{ firewall is mapping | ternary([firewall], firewall) | list if firewall is not none else [] }}"
|
|
firewall_lib_config_list: "{{ firewall_config_list | map('dict2items') | map('rejectattr', 'key', 'match', '^detailed$') | map('list') | map('items2dict') | list
|
|
}}"
|
|
_detailed:
|
|
detailed: true
|
|
firewall_detailed_facts: "{{ firewall == _detailed or firewall == [_detailed] }}"
|
|
block:
|
|
- name: Configure firewall
|
|
firewall_lib:
|
|
config_list: "{{ firewall_lib_config_list }}"
|
|
online: "{{ __firewall_is_booted }}"
|
|
__called_from_role: true
|
|
when: firewall_lib_config_list | length > 0
|
|
check_mode: "{{ __firewall_test_check_mode | d(ansible_check_mode) }}"
|
|
register: firewall_lib_result
|
|
|
|
- name: Show diffs
|
|
ansible.builtin.debug:
|
|
msg: "{{ firewall_lib_result.diff | to_nice_json }}"
|
|
when:
|
|
- ansible_check_mode or ansible_diff_mode or __firewall_test_check_mode | d(false)
|
|
- firewall_lib_result.diff | d({}) | length > 0
|
|
|
|
# If changed is false, short_circuit should be true - this means the module
|
|
# was able to determine that the desired configuration is exactly the same as
|
|
# the current configuration and no changes are needed.
|
|
- name: Check if short circuit is false
|
|
ansible.builtin.fail:
|
|
msg: The role reported no changes but short circuit is false
|
|
when:
|
|
- not (__firewall_test_check_mode | d(ansible_check_mode))
|
|
- not __firewall_debug_short_circuit_disable | d(false)
|
|
- __firewall_debug_short_circuit | d(false)
|
|
- not firewall_lib_result.changed
|
|
- firewall_lib_result.short_circuit is defined
|
|
- not firewall_lib_result.short_circuit | bool
|
|
|
|
- name: Gather firewall ansible facts if no args
|
|
when: firewall_lib_config_list | length == 0
|
|
block:
|
|
- name: Gather firewall config if no arguments
|
|
firewall_lib_facts:
|
|
online: "{{ __firewall_is_booted }}"
|
|
detailed: "{{ firewall_detailed_facts }}"
|
|
register: __firewalld_facts
|
|
|
|
- name: Update firewalld_config fact
|
|
ansible.builtin.set_fact:
|
|
firewall_config: "{{ __firewalld_facts.firewall_config }}"
|