roles/common: simplify firewall tasks

Apply firewall tag to included tasks, then we don't need to use a
block.

roles/common/tasks/firewall.yml

@@ -1,12 +1,20 @@
 ---
 - name: Configure firewall (Debian)
-  ansible.builtin.include_tasks: firewall_Debian.yml
   when: ansible_distribution == 'Debian'
+  ansible.builtin.include_tasks:
+    file: firewall_Debian.yml
+    apply:
+      tags:
+        - firewall
   tags: firewall
 
 - name: Configure firewall (Ubuntu)
-  ansible.builtin.include_tasks: firewall_Ubuntu.yml
   when: ansible_distribution == 'Ubuntu'
+  ansible.builtin.include_tasks:
+    file: firewall_Ubuntu.yml
+    apply:
+      tags:
+        - firewall
   tags: firewall
 
 

roles/common/tasks/firewall_Debian.yml

@@ -1,8 +1,7 @@
 ---
 # Debian 11+ will use nftables directly, with no firewalld.
 
-- block:
+- name: Install Debian firewall packages
-    - name: Install Debian firewall packages
   when: ansible_distribution_major_version is version('11', '>=')
   ansible.builtin.package:
     name:
@@ -12,13 +11,13 @@
     state: present
     cache_valid_time: 3600
 
-    - name: Remove iptables on newer Debian
+- name: Remove iptables on newer Debian
   when: ansible_distribution_major_version is version('11', '>=')
   ansible.builtin.apt:
     pkg: iptables
     state: absent
 
-    - name: Copy nftables.conf
+- name: Copy nftables.conf
   when: ansible_distribution_major_version is version('11', '>=')
   ansible.builtin.template:
     src: nftables.conf.j2
@@ -29,7 +28,7 @@
     - restart nftables
     - restart fail2ban
 
-    - name: Create /etc/nftables extra config directory
+- name: Create /etc/nftables extra config directory
   when: ansible_distribution_major_version is version('11', '>=')
   ansible.builtin.file:
     path: /etc/nftables
@@ -37,7 +36,7 @@
     owner: root
     mode: "0755"
 
-    - name: Copy extra nftables configuration files
+- name: Copy extra nftables configuration files
   when: ansible_distribution_major_version is version('11', '>=')
   ansible.builtin.copy:
     src: "{{ item.src }}"
@@ -56,7 +55,7 @@
     - restart nftables
     - restart fail2ban
 
-    - name: Copy nftables update scripts
+- name: Copy nftables update scripts
   when: ansible_distribution_version is version('11', '>=')
   ansible.builtin.copy:
     src: "{{ item }}"
@@ -69,7 +68,7 @@
     - aggregate-cidr-addresses.pl
     - update-abusech-nftables.sh
 
-    - name: Copy nftables systemd units
+- name: Copy nftables systemd units
   when: ansible_distribution_version is version('11', '>=')
   ansible.builtin.copy:
     src: "{{ item }}"
@@ -84,13 +83,13 @@
     - update-abusech-nftables.timer
   register: nftables_systemd_units
 
-    # need to reload to pick up service/timer/environment changes
+# need to reload to pick up service/timer/environment changes
-    - name: Reload systemd daemon
+- name: Reload systemd daemon
   ansible.builtin.systemd:
     daemon_reload: true
   when: nftables_systemd_units is changed
 
-    - name: Start and enable nftables update timers
+- name: Start and enable nftables update timers
   when: ansible_distribution_version is version('11', '>=')
   ansible.builtin.systemd:
     name: "{{ item }}"
@@ -100,16 +99,15 @@
     - update-spamhaus-nftables.timer
     - update-abusech-nftables.timer
 
-    - name: Start and enable nftables
+- name: Start and enable nftables
   when: ansible_distribution_major_version is version('11', '>=')
   ansible.builtin.systemd:
     name: nftables
     state: started
     enabled: true
 
-    - ansible.builtin.include_tasks: fail2ban.yml
+- ansible.builtin.include_tasks: fail2ban.yml
   when:
     - ansible_distribution_major_version is version('9', '>=')
-  tags: firewall
 
 # vim: set sw=2 ts=2:

roles/common/tasks/firewall_Ubuntu.yml

@@ -1,8 +1,7 @@
 ---
 # Ubuntu 20.04 will use nftables directly, with no firewalld.
 
-- block:
+- name: Install Ubuntu firewall packages
-    - name: Install Ubuntu firewall packages
   when: ansible_distribution_version is version('20.04', '>=')
   ansible.builtin.package:
     name:
@@ -12,12 +11,12 @@
     state: present
     cache_valid_time: 3600
 
-    - name: Remove ufw
+- name: Remove ufw
   ansible.builtin.package:
     name: ufw
     state: absent
 
-    - name: Copy nftables.conf
+- name: Copy nftables.conf
   when: ansible_distribution_version is version('20.04', '>=')
   ansible.builtin.template:
     src: nftables.conf.j2
@@ -28,7 +27,7 @@
     - restart nftables
     - restart fail2ban
 
-    - name: Create /etc/nftables extra config directory
+- name: Create /etc/nftables extra config directory
   when: ansible_distribution_version is version('20.04', '>=')
   ansible.builtin.file:
     path: /etc/nftables
@@ -36,7 +35,7 @@
     owner: root
     mode: "0755"
 
-    - name: Copy extra nftables configuration files
+- name: Copy extra nftables configuration files
   when: ansible_distribution_version is version('20.04', '>=')
   ansible.builtin.copy:
     src: "{{ item.src }}"
@@ -55,7 +54,7 @@
     - restart nftables
     - restart fail2ban
 
-    - name: Copy nftables update scripts
+- name: Copy nftables update scripts
   when: ansible_distribution_version is version('20.04', '>=')
   ansible.builtin.copy:
     src: "{{ item }}"
@@ -68,7 +67,7 @@
     - aggregate-cidr-addresses.pl
     - update-abusech-nftables.sh
 
-    - name: Copy nftables systemd units
+- name: Copy nftables systemd units
   when: ansible_distribution_version is version('20.04', '>=')
   ansible.builtin.copy:
     src: "{{ item }}"
@@ -83,13 +82,13 @@
     - update-abusech-nftables.timer
   register: nftables_systemd_units
 
-    # need to reload to pick up service/timer/environment changes
+# need to reload to pick up service/timer/environment changes
-    - name: Reload systemd daemon
+- name: Reload systemd daemon
   ansible.builtin.systemd:
     daemon_reload: true
   when: nftables_systemd_units is changed
 
-    - name: Start and enable nftables update timers
+- name: Start and enable nftables update timers
   when: ansible_distribution_version is version('20.04', '>=')
   ansible.builtin.systemd:
     name: "{{ item }}"
@@ -99,16 +98,15 @@
     - update-spamhaus-nftables.timer
     - update-abusech-nftables.timer
 
-    - name: Start and enable nftables
+- name: Start and enable nftables
   when: ansible_distribution_version is version('20.04', '>=')
   ansible.builtin.systemd:
     name: nftables
     state: started
     enabled: true
 
-    - ansible.builtin.include_tasks: fail2ban.yml
+- ansible.builtin.include_tasks: fail2ban.yml
   when:
     - ansible_distribution_version is version('16.04', '>=')
-  tags: firewall
 
 # vim: set sw=2 ts=2: