From 19c5371601f4f89e85d4362798096f014c441039 Mon Sep 17 00:00:00 2001
From: Damien <sepales.pret0h@icloud.com>
Date: Mon, 1 Jun 2026 10:21:18 +0200
Subject: [PATCH 1/3] Update homelab playbook and UFW role

Change hosts target from online to managed
Add tags to UFW role tasks
Set default UFW policies
Allow traffic on Tailscale interface
---
 homelab.yml                 | 10 +++++++---
 roles/ufw/defaults/main.yml |  3 ++-
 roles/ufw/tasks/main.yml    |  5 +++++
 3 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/homelab.yml b/homelab.yml
index 8128b6b..c534422 100644
--- a/homelab.yml
+++ b/homelab.yml
@@ -1,11 +1,15 @@
 # yaml-language-server: $schema=https://raw.githubusercontent.com/ansible/ansible-lint/main/src/ansiblelint/schemas/playbook.json
 ---
 - name: Homelab alignment
-  hosts: online
+  hosts: managed
   become: true
 
   roles:
-    - role: repos
-    - role: common
     - role: ufw
+      tags: ufw
+
+    - role: repos
+      tags: repos
+
     - role: upgrade
+      tags: upgrade
diff --git a/roles/ufw/defaults/main.yml b/roles/ufw/defaults/main.yml
index bef122b..869a23f 100644
--- a/roles/ufw/defaults/main.yml
+++ b/roles/ufw/defaults/main.yml
@@ -1,4 +1,5 @@
 # roles/ufw/defaults/main.yml
 ---
+ufw_default_incoming_policy: deny
+ufw_default_outgoing_policy: allow
 ufw_tailscale_interface: tailscale0
-ufw_extra_rules: []
diff --git a/roles/ufw/tasks/main.yml b/roles/ufw/tasks/main.yml
index e69de29..ddbc547 100644
--- a/roles/ufw/tasks/main.yml
+++ b/roles/ufw/tasks/main.yml
@@ -0,0 +1,5 @@
+- name: Allow all traffic on Tailscale interface
+  community.general.ufw:
+    rule: allow
+    interface: "{{ ufw_tailscale_interface }}"
+    direction: in

From 38e73c9c96de8d67222e4b595873416770e864fa Mon Sep 17 00:00:00 2001
From: Damien <sepales.pret0h@icloud.com>
Date: Mon, 1 Jun 2026 10:45:59 +0200
Subject: [PATCH 2/3] Add UFW installation and configuration tasks

---
 roles/ufw/tasks/main.yml | 41 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)

diff --git a/roles/ufw/tasks/main.yml b/roles/ufw/tasks/main.yml
index ddbc547..678c54e 100644
--- a/roles/ufw/tasks/main.yml
+++ b/roles/ufw/tasks/main.yml
@@ -1,3 +1,44 @@
+---
+# roles/ufw/tasks/main.yml
+
+- name: Install UFW (Alpine)
+  community.general.apk:
+    name: ufw
+    state: present
+    update_cache: true
+  when: ansible_facts['os_family'] == "Alpine"
+
+- name: Install UFW (Debian)
+  ansible.builtin.apt:
+    name: ufw
+    state: present
+    update_cache: true
+  when: ansible_facts['os_family'] == "Debian"
+
+- name: Add UFW to default runlevel (Alpine)
+  ansible.builtin.command:
+    cmd: rc-update add ufw default
+  register: rc_update_result
+  changed_when: >-
+    'already' not in rc_update_result.stdout
+    and 'already' not in rc_update_result.stderr
+  failed_when: rc_update_result.rc != 0
+  when: ansible_facts['os_family'] == "Alpine"
+
+- name: Set default incoming policy
+  community.general.ufw:
+    default: "{{ ufw_default_incoming_policy }}"
+    direction: incoming
+
+- name: Set default outgoing policy
+  community.general.ufw:
+    default: "{{ ufw_default_outgoing_policy }}"
+    direction: outgoing
+
+- name: Enable UFW
+  community.general.ufw:
+    state: enabled
+
 - name: Allow all traffic on Tailscale interface
   community.general.ufw:
     rule: allow

From 5768492bd37f9f9ad9eed2bc31ede967a018d27a Mon Sep 17 00:00:00 2001
From: Damien <sepales.pret0h@icloud.com>
Date: Mon, 1 Jun 2026 10:48:05 +0200
Subject: [PATCH 3/3] Update UFW rc-update changed condition

---
 roles/ufw/tasks/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/ufw/tasks/main.yml b/roles/ufw/tasks/main.yml
index 678c54e..afa9476 100644
--- a/roles/ufw/tasks/main.yml
+++ b/roles/ufw/tasks/main.yml
@@ -19,7 +19,7 @@
   ansible.builtin.command:
     cmd: rc-update add ufw default
   register: rc_update_result
-  changed_when: >-
+  changed_when: >- # ">- : transform multiple lines into one line"
     'already' not in rc_update_result.stdout
     and 'already' not in rc_update_result.stderr
   failed_when: rc_update_result.rc != 0