---
- name: Install firewalld
  ansible.builtin.package:
    name: firewalld
    state: present
  tags: [firewall_config]

- name: Enable and start firewalld
  ansible.builtin.systemd:
    name: firewalld
    enabled: true
    state: started
  tags: [firewall_config]

- name: Enable the restrictive default zone
  ansible.posix.firewalld:
    zone: "{{ firewall_default_zone }}"
    state: enabled
    permanent: true
    immediate: true
  tags: [firewall_config]

- name: Set the restrictive zone as system default
  ansible.builtin.command: "firewall-cmd --set-default-zone={{ firewall_default_zone }}"
  changed_when: true
  tags: [firewall_config]

- name: Enable logging of denied packets
  ansible.builtin.command: "firewall-cmd --set-log-denied={{ firewall_log_denied }}"
  changed_when: true
  tags: [firewall_config]

- name: Allow SSH only from the administration subnet
  ansible.posix.firewalld:
    zone: "{{ firewall_default_zone }}"
    rich_rule: >-
      rule family="ipv4" source address="{{ firewall_admin_subnet }}"
      port protocol="tcp" port="{{ ssh_port | default(22) }}" accept
    permanent: true
    immediate: true
    state: enabled
  tags: [firewall_config]

- name: Allow defined application services/ports
  ansible.posix.firewalld:
    zone: "{{ firewall_default_zone }}"
    rich_rule: >-
      rule family="ipv4"
      {{ 'source address="' + item.source + '"' if item.source is defined and item.source != 'any' else '' }}
      service name="{{ item.service }}" accept
    permanent: true
    immediate: true
    state: enabled
  loop: "{{ firewall_allowed_services }}"
  when: firewall_allowed_services | length > 0
  tags: [firewall_config]