c86df61152
Add `excluded` host group and skip offline hosts Fix UFW service initialization command for Alpine Linux
47 lines
1.2 KiB
YAML
47 lines
1.2 KiB
YAML
---
|
|
# roles/ufw/tasks/main.yml
|
|
|
|
- name: Install UFW (Alpine)
|
|
community.general.apk:
|
|
name: ufw
|
|
state: present
|
|
update_cache: true
|
|
when: ansible_facts['os_family'] == "Alpine"
|
|
|
|
- name: Install UFW (Debian)
|
|
ansible.builtin.apt:
|
|
name: ufw
|
|
state: present
|
|
update_cache: true
|
|
when: ansible_facts['os_family'] == "Debian"
|
|
|
|
- name: Add UFW to default runlevel (Alpine)
|
|
ansible.builtin.command:
|
|
cmd: /sbin/rc-update add ufw default
|
|
register: ufw_rc_update_result
|
|
changed_when: >- # " >- : transform multiple lines into one line"
|
|
'already' not in ufw_rc_update_result.stdout
|
|
and 'already' not in ufw_rc_update_result.stderr
|
|
failed_when: ufw_rc_update_result.rc != 0
|
|
when: ansible_facts['os_family'] == "Alpine"
|
|
|
|
- name: Set default incoming policy
|
|
community.general.ufw:
|
|
default: "{{ ufw_default_incoming_policy }}"
|
|
direction: incoming
|
|
|
|
- name: Set default outgoing policy
|
|
community.general.ufw:
|
|
default: "{{ ufw_default_outgoing_policy }}"
|
|
direction: outgoing
|
|
|
|
- name: Enable UFW
|
|
community.general.ufw:
|
|
state: enabled
|
|
|
|
- name: Allow all traffic on Tailscale interface
|
|
community.general.ufw:
|
|
rule: allow
|
|
interface: "{{ ufw_tailscale_interface }}"
|
|
direction: in
|