roles/ufw/tasks/main.yml

@@ -1,3 +1,44 @@
+---
+# roles/ufw/tasks/main.yml
+
+- name: Install UFW (Alpine)
+  community.general.apk:
+    name: ufw
+    state: present
+    update_cache: true
+  when: ansible_facts['os_family'] == "Alpine"
+
+- name: Install UFW (Debian)
+  ansible.builtin.apt:
+    name: ufw
+    state: present
+    update_cache: true
+  when: ansible_facts['os_family'] == "Debian"
+
+- name: Add UFW to default runlevel (Alpine)
+  ansible.builtin.command:
+    cmd: rc-update add ufw default
+  register: rc_update_result
+  changed_when: >-
+    'already' not in rc_update_result.stdout
+    and 'already' not in rc_update_result.stderr
+  failed_when: rc_update_result.rc != 0
+  when: ansible_facts['os_family'] == "Alpine"
+
+- name: Set default incoming policy
+  community.general.ufw:
+    default: "{{ ufw_default_incoming_policy }}"
+    direction: incoming
+
+- name: Set default outgoing policy
+  community.general.ufw:
+    default: "{{ ufw_default_outgoing_policy }}"
+    direction: outgoing
+
+- name: Enable UFW
+  community.general.ufw:
+    state: enabled
+
 - name: Allow all traffic on Tailscale interface
   community.general.ufw:
     rule: allow