47 lines
1.1 KiB
YAML
47 lines
1.1 KiB
YAML
---
|
|
# roles/ufw/tasks/main.yml
|
|
|
|
- name: Install UFW (Alpine)
|
|
community.general.apk:
|
|
name: ufw
|
|
state: present
|
|
update_cache: true
|
|
when: ansible_facts['os_family'] == "Alpine"
|
|
|
|
- name: Install UFW (Debian)
|
|
ansible.builtin.apt:
|
|
name: ufw
|
|
state: present
|
|
update_cache: true
|
|
when: ansible_facts['os_family'] == "Debian"
|
|
|
|
- name: Add UFW to default runlevel (Alpine)
|
|
ansible.builtin.command:
|
|
cmd: rc-update add ufw default
|
|
register: rc_update_result
|
|
changed_when: >-
|
|
'already' not in rc_update_result.stdout
|
|
and 'already' not in rc_update_result.stderr
|
|
failed_when: rc_update_result.rc != 0
|
|
when: ansible_facts['os_family'] == "Alpine"
|
|
|
|
- name: Set default incoming policy
|
|
community.general.ufw:
|
|
default: "{{ ufw_default_incoming_policy }}"
|
|
direction: incoming
|
|
|
|
- name: Set default outgoing policy
|
|
community.general.ufw:
|
|
default: "{{ ufw_default_outgoing_policy }}"
|
|
direction: outgoing
|
|
|
|
- name: Enable UFW
|
|
community.general.ufw:
|
|
state: enabled
|
|
|
|
- name: Allow all traffic on Tailscale interface
|
|
community.general.ufw:
|
|
rule: allow
|
|
interface: "{{ ufw_tailscale_interface }}"
|
|
direction: in
|