From 67c99dacf6a3f861c100f71044520de8473d3d6f Mon Sep 17 00:00:00 2001
From: Alan Orth <alan.orth@gmail.com>
Date: Mon, 12 Sep 2022 17:18:33 +0300
Subject: [PATCH] roles/common: rework firewall_Ubuntu.yml playbook

Use newer Ansible task format, move from apt to package module, and
do package installs in one transaction using a list instead of a loop.
---
 roles/common/tasks/firewall_Ubuntu.yml | 64 +++++++++++++++++++-------
 1 file changed, 47 insertions(+), 17 deletions(-)

diff --git a/roles/common/tasks/firewall_Ubuntu.yml b/roles/common/tasks/firewall_Ubuntu.yml
index 69c9e62..92bd7be 100644
--- a/roles/common/tasks/firewall_Ubuntu.yml
+++ b/roles/common/tasks/firewall_Ubuntu.yml
@@ -2,37 +2,50 @@
 # Ubuntu 20.04 will use nftables directly, with no firewalld.
 
 - block:
-  - name: Set Ubuntu firewall packages
-    when: ansible_distribution_version is version('20.04', '>=')
-    ansible.builtin.set_fact:
-      ubuntu_firewall_packages:
+  - name: Install Ubuntu firewall packages
+    ansible.builtin.package:
+      name:
         - fail2ban
         - libnet-ip-perl # for aggregate-cidr-addresses.pl
         - nftables
         - python3-systemd
         - curl # for nftables update scripts
-
-  - name: Install firewall packages
-    ansible.builtin.apt: pkg={{ ubuntu_firewall_packages }} state=present cache_valid_time=3600
+      state: present
+      cache_valid_time: 3600
 
   - name: Remove ufw
-    when: ansible_distribution_version is version('16.04', '>=')
-    ansible.builtin.apt: pkg=ufw state=absent
+    ansible.builtin.package:
+      name: ufw
+      state: absent
 
   - name: Copy nftables.conf
     when: ansible_distribution_version is version('20.04', '>=')
-    ansible.builtin.template: src=nftables.conf.j2 dest=/etc/nftables.conf owner=root mode=0644
+    ansible.builtin.template:
+      src: nftables.conf.j2
+      dest: /etc/nftables.conf
+      owner: root
+      mode: 0644
     notify:
       - restart nftables
       - restart fail2ban
 
   - name: Create /etc/nftables extra config directory
     when: ansible_distribution_version is version('20.04', '>=')
-    ansible.builtin.file: path=/etc/nftables state=directory owner=root mode=0755
+    ansible.builtin.file:
+      path: /etc/nftables
+      state: directory
+      owner: root
+      mode: 0755
 
   - name: Copy extra nftables configuration files
     when: ansible_distribution_version is version('20.04', '>=')
-    ansible.builtin.copy: src={{ item.src }} dest=/etc/nftables/{{ item.src }} owner=root group=root mode=0644 force={{ item.force }}
+    ansible.builtin.copy:
+      src: "{{ item.src }}"
+      dest: "/etc/nftables/{{ item.src }}"
+      owner: root
+      group: root
+      mode: 0644
+      force: "{{ item.force }}"
     loop:
       - { src: "spamhaus-ipv4.nft", force: "no" }
       - { src: "spamhaus-ipv6.nft", force: "no" }
@@ -45,7 +58,12 @@
 
   - name: Copy nftables update scripts
     when: ansible_distribution_version is version('20.04', '>=')
-    ansible.builtin.copy: src={{ item }} dest=/usr/local/bin/{{ item }} mode=0755 owner=root group=root
+    ansible.builtin.copy:
+      src: "{{ item }}"
+      dest: "/usr/local/bin/{{ item }}"
+      mode: 0755
+      owner: root
+      group: root
     loop:
       - update-spamhaus-nftables.sh
       - aggregate-cidr-addresses.pl
@@ -53,7 +71,12 @@
 
   - name: Copy nftables systemd units
     when: ansible_distribution_version is version('20.04', '>=')
-    ansible.builtin.copy: src={{ item }} dest=/etc/systemd/system/{{ item }} mode=0644 owner=root group=root
+    ansible.builtin.copy:
+      src: "{{ item }}"
+      dest: "/etc/systemd/system/{{ item }}"
+      mode: 0644
+      owner: root
+      group: root
     loop:
         - update-spamhaus-nftables.service
         - update-spamhaus-nftables.timer
@@ -63,19 +86,26 @@
 
   # need to reload to pick up service/timer/environment changes
   - name: Reload systemd daemon
-    ansible.builtin.systemd: daemon_reload=true
+    ansible.builtin.systemd:
+      daemon_reload: true
     when: nftables_systemd_units is changed
 
   - name: Start and enable nftables update timers
     when: ansible_distribution_version is version('20.04', '>=')
-    ansible.builtin.systemd: name={{ item }} state=started enabled=true
+    ansible.builtin.systemd:
+      name: "{{ item }}"
+      state: started
+      enabled: true
     loop:
       - update-spamhaus-nftables.timer
       - update-abusech-nftables.timer
 
   - name: Start and enable nftables
     when: ansible_distribution_version is version('20.04', '>=')
-    ansible.builtin.systemd: name=nftables state=started enabled=true
+    ansible.builtin.systemd:
+      name: nftables
+      state: started
+      enabled: true
 
   - ansible.builtin.include_tasks: fail2ban.yml
     when: ansible_distribution_version is version('16.04', '>=')