-
Notifications
You must be signed in to change notification settings - Fork 8
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Added Archlinux support for
firewall
role
- Loading branch information
Showing
4 changed files
with
86 additions
and
75 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,16 @@ | ||
--- | ||
- name: Restarting nftables... | ||
ansible.builtin.systemd: | ||
name: nftables.service | ||
state: restarted | ||
enabled: true | ||
daemon_reload: true | ||
|
||
- name: Restarting Docker... | ||
ansible.builtin.systemd: | ||
name: docker.service | ||
state: restarted | ||
|
||
- name: Rebooting... | ||
ansible.builtin.reboot: | ||
when: ansible_os_family == "Archlinux" # For some reason nftables does not work without a reboot on Archlinux |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,77 +1,81 @@ | ||
--- | ||
- name: Removing nftables... | ||
ansible.builtin.apt: | ||
ansible.builtin.package: | ||
name: nftables | ||
state: absent | ||
|
||
- name: Installing iptables... | ||
ansible.builtin.apt: | ||
name: | ||
- iptables | ||
- iptables-persistent | ||
ansible.builtin.package: | ||
name: iptables | ||
state: present | ||
update_cache: true | ||
register: firewall_dependencies_install | ||
until: not firewall_dependencies_install.failed # Because sometimes the primary DNS is not up yet or egress FW is still being deployed | ||
register: iptables_install | ||
until: not iptables_install.failed # Because sometimes the primary DNS is not up yet or egress FW is still being deployed | ||
retries: 10 | ||
delay: 6 | ||
|
||
- name: Enabling netfilter-persistent service... | ||
ansible.builtin.service: | ||
name: netfilter-persistent | ||
enabled: true | ||
|
||
- name: Creating iptables directory... | ||
ansible.builtin.file: | ||
path: /etc/iptables | ||
state: directory | ||
mode: "0755" | ||
|
||
- name: Templating iptables IPv4 rules... | ||
ansible.builtin.template: | ||
src: "{{ ipv4_template_file }}" | ||
dest: /etc/iptables/rules.v4 | ||
lstrip_blocks: true | ||
mode: "0644" | ||
register: ipv4_rules_result | ||
- name: Installing and configuring iptables for Debian based OS... | ||
when: ansible_os_family == "Debian" | ||
block: | ||
- name: Installing iptables-persistent... | ||
ansible.builtin.package: | ||
name: | ||
- iptables-persistent | ||
state: present | ||
register: iptables_persistent_isntall | ||
until: not iptables_persistent_isntall.failed # Because sometimes the primary DNS is not up yet or egress FW is still being deployed | ||
retries: 10 | ||
delay: 6 | ||
|
||
- name: Templating iptables IPv6 rules... | ||
ansible.builtin.template: | ||
src: "{{ ipv6_template_file }}" | ||
dest: /etc/iptables/rules.v6 | ||
lstrip_blocks: true | ||
mode: "0644" | ||
register: ipv6_rules_result | ||
- name: Enabling netfilter-persistent service... | ||
ansible.builtin.service: | ||
name: netfilter-persistent | ||
enabled: true | ||
|
||
- name: Restoring iptables IPv4 rules, if required... | ||
ansible.builtin.shell: iptables-restore </etc/iptables/rules.v4 | ||
changed_when: true | ||
when: ipv4_rules_result.changed | ||
- name: Templating iptables IPv4 rules... | ||
ansible.builtin.template: | ||
src: "{{ ipv4_template_file }}" | ||
dest: /etc/iptables/rules.v4 | ||
lstrip_blocks: true | ||
mode: "0644" | ||
register: ipv4_rules_result | ||
|
||
- name: Restoring iptables IPv6 rules, if required... | ||
ansible.builtin.shell: ip6tables-restore </etc/iptables/rules.v6 | ||
changed_when: true | ||
when: ipv6_rules_result.changed | ||
- name: Templating iptables IPv6 rules... | ||
ansible.builtin.template: | ||
src: "{{ ipv6_template_file }}" | ||
dest: /etc/iptables/rules.v6 | ||
lstrip_blocks: true | ||
mode: "0644" | ||
register: ipv6_rules_result | ||
|
||
- name: Starting & enabling iptables... | ||
ansible.builtin.systemd: | ||
name: iptables.service | ||
state: started | ||
enabled: true | ||
daemon_reload: true | ||
- name: Restoring iptables IPv4 rules, if required... | ||
ansible.builtin.shell: iptables-restore </etc/iptables/rules.v4 | ||
changed_when: true | ||
when: ipv4_rules_result.changed | ||
|
||
- name: Restarting iptables & required services... | ||
when: ipv4_rules_result.changed or ipv6_rules_result.changed | ||
block: | ||
- name: Checking if Docker service exists... | ||
ansible.builtin.systemd: | ||
name: docker.service | ||
register: docker_service_exists | ||
- name: Restoring iptables IPv6 rules, if required... | ||
ansible.builtin.shell: ip6tables-restore </etc/iptables/rules.v6 | ||
changed_when: true | ||
when: ipv6_rules_result.changed | ||
|
||
# This part is required to make sure automatic Docker IPTables rules get re-populated | ||
- name: Restarting Docker service... | ||
- name: Starting & enabling iptables... | ||
ansible.builtin.systemd: | ||
name: docker.service | ||
state: restarted | ||
name: iptables.service | ||
state: started | ||
enabled: true | ||
when: docker_service_exists.status.LoadState != "not-found" | ||
daemon_reload: true | ||
|
||
# This is required to make sure automatic Docker IPTables rules get re-populated | ||
- name: Checking if Docker service exists... | ||
ansible.builtin.systemd: | ||
name: docker.service | ||
register: docker_service_exists | ||
changed_when: docker_service_exists.status.LoadState != "not-found" | ||
notify: Restarting Docker... | ||
when: ipv4_rules_result.changed or ipv6_rules_result.changed |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters