roles/common: Add firewalld support

Needed in Ubuntu 15.04 where iptables-persistent is going away. I
have added translations of the current IPv4 and IPv6 iptables rules.

Signed-off-by: Alan Orth <alan.orth@gmail.com>

roles/common/handlers/main.yml

@@ -12,3 +12,6 @@
 
 - name: reload sysctl
   command: sysctl -p /etc/sysctl.conf
+
+- name: restart firewalld
+  service: name=firewalld state=restarted

roles/common/tasks/iptables_Debian.yml

@@ -1,13 +1,33 @@
 ---
 - name: Install iptables-persistent
+  when: ansible_distribution_version == '14.04'
   apt: pkg=iptables-persistent update_cache=yes
 
 - name: Copy /etc/iptables/rules.v4
+  when: ansible_distribution_version == '14.04'
   template: src=iptables.j2 dest=/etc/iptables/rules.v4 owner=root mode=0600
   notify:
     - restart iptables-persistent
 
 - name: Copy /etc/iptables/rules.v6
+  when: ansible_distribution_version == '14.04'
   template: src=ip6tables.j2 dest=/etc/iptables/rules.v6 owner=root group=root mode=0600
   notify:
     - restart iptables-persistent
+
+- name: Install firewalld and deps
+  when: ansible_distribution_version == '15.04'
+  apt: pkg={{ item }} state=latest
+  with_items:
+    - firewalld
+    - tidy
+
+- name: Copy firewalld public zone file
+  when: ansible_distribution_version == '15.04'
+  template: src=public.xml.j2 dest=/etc/firewalld/zones/public.xml owner=root mode=0600
+
+- name: Format public.xml firewalld zone file
+  when: ansible_distribution_version == '15.04'
+  shell: tidy -xml -iq -m -w 0 /etc/firewalld/zones/public.xml
+  notify:
+    - restart firewalld

roles/common/templates/public.xml.j2

@@ -0,0 +1,63 @@
+<zone>
+    <short>Public</short>
+    <description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
+    <interface name="{{ ansible_default_ipv4.alias }}"/>
+
+    {# ssh rules #}
+    <rule family="ipv4">
+        <source address="0.0.0.0/0"/>
+        <port protocol="tcp" port="22"/>
+        <accept/>
+    </rule>
+
+    {# ipv6 ssh rules #}
+    <rule family="ipv6">
+        <source address="::/0"/>
+        <port protocol="tcp" port="22"/>
+        <accept/>
+    </rule>
+
+    {# web rules #}
+    <rule family="ipv4">
+        <source address="0.0.0.0/0"/>
+        <port protocol="tcp" port="80"/>
+        <accept/>
+    </rule>
+
+    {# ipv6 web rules #}
+    <rule family="ipv6">
+        <source address="::/0"/>
+        <port protocol="tcp" port="80"/>
+        <accept/>
+    </rule>
+
+    {# munin rules #}
+    {% if munin_master_host is defined %}
+    <rule family="ipv4">
+        <source address="{{ ghetto_ipsets[munin_master_host].src }}"/>
+        <port protocol="tcp" port="{{ munin_node_port }}"/>
+        <accept/>
+    </rule>
+    {% endif %}
+
+    {# extra rules #}
+    {% if extra_iptables_rules is defined %}
+    {% for rule in extra_iptables_rules %}
+    <rule family="ipv4">
+        <source address="{{ ghetto_ipsets[rule.acl].src }}"/>
+        <port protocol="{{ rule.protocol }}" port="{{ rule.port }}"/>
+        <accept/>
+    </rule>
+
+    {# ipv6 extra rules #}
+    {% if ghetto_ipsets[rule.acl].ipv6src is defined %}
+    <rule family="ipv6">
+        <source address="{{ ghetto_ipsets[rule.acl].ipv6src }}"/>
+        <port protocol="{{ rule.protocol }}" port="{{ rule.port }}"/>
+        <accept/>
+    </rule>
+    {% endif %}
+
+    {% endfor %}
+    {% endif %}
+</zone>