ansible-personal/roles/common/tasks/firewall_Debian.yml

---
- name: Install firewalld and deps
  when: ansible_distribution_major_version | version_compare('8', '>=')
  apt: pkg={{ item }} state=latest
  with_items:
    - firewalld
    - tidy
  tags: packages

- name: Copy firewalld public zone file
  when: ansible_distribution_major_version | version_compare('8', '>=')
  template: src=public.xml.j2 dest=/etc/firewalld/zones/public.xml owner=root mode=0600

- name: Format public.xml firewalld zone file
  when: ansible_distribution_major_version | version_compare('8', '>=')
  command: tidy -xml -iq -m -w 0 /etc/firewalld/zones/public.xml
  notify:
    - reload firewalld
Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-08-16 23:35:57 +02:00			`---`
roles/common: Add firewalld support Needed in Ubuntu 15.04 where iptables-persistent is going away. I have added translations of the current IPv4 and IPv6 iptables rules. Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-06-07 11:42:03 +02:00			`- name: Install firewalld and deps`
roles/common: Enable firewalld in Debian 9 2017-09-26 13:30:18 +02:00			`when: ansible_distribution_major_version \| version_compare('8', '>=')`
Revert "Only update packages indexes if the cache is 1 hour old" This reverts commit 201165cff662caad9b51508272e7f8f2eece7b0c. Turns out this actually breaks initial deployments, because the cache gets updated in the first task, then you add sources for nginx and mariadb, but it doesn't update the indexes because the cache is < 3600 seconds old, so you end up getting the distro's versions of nginx and mariadb. 2016-08-25 11:58:15 +02:00			`apt: pkg={{ item }} state=latest`
roles/common: Add firewalld support Needed in Ubuntu 15.04 where iptables-persistent is going away. I have added translations of the current IPv4 and IPv6 iptables rules. Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-06-07 11:42:03 +02:00			`with_items:`
			`- firewalld`
			`- tidy`
Add 'packages' tag to any task doing package stuff For idempotence we need to run all apt-related tasks, like editing source files, adding keys, installing packages, etc, when running the 'packages' tag. 2016-08-14 15:33:48 +02:00			`tags: packages`
roles/common: Add firewalld support Needed in Ubuntu 15.04 where iptables-persistent is going away. I have added translations of the current IPv4 and IPv6 iptables rules. Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-06-07 11:42:03 +02:00
			`- name: Copy firewalld public zone file`
roles/common: Enable firewalld in Debian 9 2017-09-26 13:30:18 +02:00			`when: ansible_distribution_major_version \| version_compare('8', '>=')`
roles/common: Add firewalld support Needed in Ubuntu 15.04 where iptables-persistent is going away. I have added translations of the current IPv4 and IPv6 iptables rules. Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-06-07 11:42:03 +02:00			`template: src=public.xml.j2 dest=/etc/firewalld/zones/public.xml owner=root mode=0600`

			`- name: Format public.xml firewalld zone file`
roles/common: Enable firewalld in Debian 9 2017-09-26 13:30:18 +02:00			`when: ansible_distribution_major_version \| version_compare('8', '>=')`
roles/common: Use command module instead of shell You should only use the "shell" module when you need shell functions like flow control and redirects. Also, the "command" module is safer because it is not affected by the user's environment. 2017-11-04 23:49:03 +01:00			`command: tidy -xml -iq -m -w 0 /etc/firewalld/zones/public.xml`
roles/common: Add firewalld support Needed in Ubuntu 15.04 where iptables-persistent is going away. I have added translations of the current IPv4 and IPv6 iptables rules. Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-06-07 11:42:03 +02:00			`notify:`
roles/common: Reload firewalld instead of restart There is no need to bounce the service, just reload it. 2017-11-02 17:58:15 +01:00			`- reload firewalld`