roles/common: rework firewall_Debian.yml playbook

Use newer Ansible task format, move from apt to package module, and
do package installs in one transaction using a list instead of a
loop.

roles/common/tasks/firewall_Debian.yml

@@ -2,37 +2,52 @@
 # Debian 11 will use nftables directly, with no firewalld.
 
 - block:
-  - name: Set Debian firewall packages
+  - name: Install Debian firewall packages
     when: ansible_distribution_major_version is version('11', '>=')
-    ansible.builtin.set_fact:
-      debian_firewall_packages:
+    ansible.builtin.package:
+      name:
         - fail2ban
         - libnet-ip-perl # for aggregate-cidr-addresses.pl
         - nftables
         - python3-systemd
         - curl # for nftables update scripts
-
-  - name: Install firewall packages
-    ansible.builtin.apt: pkg={{ debian_firewall_packages }} state=present cache_valid_time=3600
+      state: present
+      cache_valid_time: 3600
 
   - name: Remove iptables on newer Debian
     when: ansible_distribution_major_version is version('11', '>=')
-    ansible.builtin.apt: pkg=iptables state=absent
+    ansible.builtin.apt:
+      pkg: iptables
+      state: absent
 
   - name: Copy nftables.conf
     when: ansible_distribution_major_version is version('11', '>=')
-    ansible.builtin.template: src=nftables.conf.j2 dest=/etc/nftables.conf owner=root mode=0644
+    ansible.builtin.template:
+      src: nftables.conf.j2
+      dest: /etc/nftables.conf
+      owner: root
+      mode: 0644
     notify:
       - restart nftables
       - restart fail2ban
 
   - name: Create /etc/nftables extra config directory
     when: ansible_distribution_major_version is version('11', '>=')
-    ansible.builtin.file: path=/etc/nftables state=directory owner=root mode=0755
+    ansible.builtin.file:
+      path: /etc/nftables
+      state: directory
+      owner: root
+      mode: 0755
 
   - name: Copy extra nftables configuration files
     when: ansible_distribution_major_version is version('11', '>=')
-    ansible.builtin.copy: src={{ item.src }} dest=/etc/nftables/{{ item.src }} owner=root group=root mode=0644 force={{ item.force }}
+    ansible.builtin.copy:
+      src: "{{ item.src }}"
+      dest: "/etc/nftables/{{ item.src }}"
+      owner: root
+      group: root
+      mode: 0644
+      force: "{{ item.force }}"
     loop:
       - { src: "spamhaus-ipv4.nft", force: "no" }
       - { src: "spamhaus-ipv6.nft", force: "no" }
@@ -43,9 +58,14 @@
       - restart nftables
       - restart fail2ban
 
-  - name: Copy Spamhaus nftables update scripts
+  - name: Copy nftables update scripts
     when: ansible_distribution_version is version('11', '>=')
-    ansible.builtin.copy: src={{ item }} dest=/usr/local/bin/{{ item }} mode=0755 owner=root group=root
+    ansible.builtin.copy:
+      src: "{{ item }}"
+      dest: "/usr/local/bin/{{ item }}"
+      mode: 0755
+      owner: root
+      group: root
     loop:
       - update-spamhaus-nftables.sh
       - aggregate-cidr-addresses.pl
@@ -53,7 +73,12 @@
 
   - name: Copy nftables systemd units
     when: ansible_distribution_version is version('11', '>=')
-    ansible.builtin.copy: src={{ item }} dest=/etc/systemd/system/{{ item }} mode=0644 owner=root group=root
+    ansible.builtin.copy:
+      src: "{{ item }}"
+      dest: "/etc/systemd/system/{{ item }}"
+      mode: 0644
+      owner: root
+      group: root
     loop:
       - update-spamhaus-nftables.service
       - update-spamhaus-nftables.timer
@@ -63,19 +88,26 @@
 
   # need to reload to pick up service/timer/environment changes
   - name: Reload systemd daemon
-    ansible.builtin.systemd: daemon_reload=true
+    ansible.builtin.systemd:
+      daemon_reload: true
     when: nftables_systemd_units is changed
 
   - name: Start and enable nftables update timers
     when: ansible_distribution_version is version('11', '>=')
-    ansible.builtin.systemd: name={{ item }} state=started enabled=true
+    ansible.builtin.systemd:
+      name: "{{ item }}"
+      state: started
+      enabled: true
     loop:
       - update-spamhaus-nftables.timer
       - update-abusech-nftables.timer
 
   - name: Start and enable nftables
     when: ansible_distribution_major_version is version('11', '>=')
-    ansible.builtin.systemd: name=nftables state=started enabled=true
+    ansible.builtin.systemd:
+      name: nftables
+      state: started
+      enabled: true
 
   - ansible.builtin.include_tasks: fail2ban.yml
     when: ansible_distribution_major_version is version('9', '>=')