---
# roles/ufw/tasks/main.yml

- name: Install UFW (Alpine)
  community.general.apk:
    name: ufw
    state: present
    update_cache: true
  when: ansible_facts['os_family'] == "Alpine"

- name: Install UFW (Debian)
  ansible.builtin.apt:
    name: ufw
    state: present
    update_cache: true
  when: ansible_facts['os_family'] == "Debian"

- name: Add UFW to default runlevel (Alpine)
  ansible.builtin.command:
    cmd: rc-update add ufw default
  register: rc_update_result
  changed_when: >-
    'already' not in rc_update_result.stdout
    and 'already' not in rc_update_result.stderr
  failed_when: rc_update_result.rc != 0
  when: ansible_facts['os_family'] == "Alpine"

- name: Set default incoming policy
  community.general.ufw:
    default: "{{ ufw_default_incoming_policy }}"
    direction: incoming

- name: Set default outgoing policy
  community.general.ufw:
    default: "{{ ufw_default_outgoing_policy }}"
    direction: outgoing

- name: Enable UFW
  community.general.ufw:
    state: enabled

- name: Allow all traffic on Tailscale interface
  community.general.ufw:
    rule: allow
    interface: "{{ ufw_tailscale_interface }}"
    direction: in