initial commit

roles/firewall_config/tasks/main.yml

@@ -0,0 +1,56 @@
+---
+- name: Install firewalld
+  ansible.builtin.package:
+    name: firewalld
+    state: present
+  tags: [firewall_config]
+
+- name: Enable and start firewalld
+  ansible.builtin.systemd:
+    name: firewalld
+    enabled: true
+    state: started
+  tags: [firewall_config]
+
+- name: Enable the restrictive default zone
+  ansible.posix.firewalld:
+    zone: "{{ firewall_default_zone }}"
+    state: enabled
+    permanent: true
+    immediate: true
+  tags: [firewall_config]
+
+- name: Set the restrictive zone as system default
+  ansible.builtin.command: "firewall-cmd --set-default-zone={{ firewall_default_zone }}"
+  changed_when: true
+  tags: [firewall_config]
+
+- name: Enable logging of denied packets
+  ansible.builtin.command: "firewall-cmd --set-log-denied={{ firewall_log_denied }}"
+  changed_when: true
+  tags: [firewall_config]
+
+- name: Allow SSH only from the administration subnet
+  ansible.posix.firewalld:
+    zone: "{{ firewall_default_zone }}"
+    rich_rule: >-
+      rule family="ipv4" source address="{{ firewall_admin_subnet }}"
+      port protocol="tcp" port="{{ ssh_port | default(22) }}" accept
+    permanent: true
+    immediate: true
+    state: enabled
+  tags: [firewall_config]
+
+- name: Allow defined application services/ports
+  ansible.posix.firewalld:
+    zone: "{{ firewall_default_zone }}"
+    rich_rule: >-
+      rule family="ipv4"
+      {{ 'source address="' + item.source + '"' if item.source is defined and item.source != 'any' else '' }}
+      service name="{{ item.service }}" accept
+    permanent: true
+    immediate: true
+    state: enabled
+  loop: "{{ firewall_allowed_services }}"
+  when: firewall_allowed_services | length > 0
+  tags: [firewall_config]