roles/common: rework firewall_Debian.yml playbook

Use newer Ansible task format, move from apt to package module, and
do package installs in one transaction using a list instead of a
loop.

ansible.cfg

@@ -2,10 +2,16 @@
 retry_files_enabled=False
 force_handlers=True
 inventory=hosts
+gathering = smart
 # instead of using --ask-vault-pass
 ask_vault_pass=True
 remote_user = provisioning
 interpreter_python=auto
+# Don't warn on unknown SSH host keys because it's super annoying for new hosts
+# or if you get a new laptop and run Ansible there!
+#
+# See: https://docs.ansible.com/ansible/latest/user_guide/connection_details.html#managing-host-key-checking
+host_key_checking = False
 
 ansible_managed = This file is managed by Ansible.%n
   template: {file}

roles/common/files/ssh-pub-keys/aorth-thinkpad2-ed25519.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHmRO6E0G4Ls3TifVfJ+mQjlfWiBZNJfsSXGhwQ/HA1M aorth@balozi

roles/common/tasks/firewall_Debian.yml

@@ -2,37 +2,52 @@
 # Debian 11 will use nftables directly, with no firewalld.
 
 - block:
-  - name: Set Debian firewall packages
+  - name: Install Debian firewall packages
     when: ansible_distribution_major_version is version('11', '>=')
-    ansible.builtin.set_fact:
+    ansible.builtin.package:
-      debian_firewall_packages:
+      name:
         - fail2ban
         - libnet-ip-perl # for aggregate-cidr-addresses.pl
         - nftables
         - python3-systemd
         - curl # for nftables update scripts
-
+      state: present
-  - name: Install firewall packages
+      cache_valid_time: 3600
-    ansible.builtin.apt: pkg={{ debian_firewall_packages }} state=present cache_valid_time=3600
 
   - name: Remove iptables on newer Debian
     when: ansible_distribution_major_version is version('11', '>=')
-    ansible.builtin.apt: pkg=iptables state=absent
+    ansible.builtin.apt:
+      pkg: iptables
+      state: absent
 
   - name: Copy nftables.conf
     when: ansible_distribution_major_version is version('11', '>=')
-    ansible.builtin.template: src=nftables.conf.j2 dest=/etc/nftables.conf owner=root mode=0644
+    ansible.builtin.template:
+      src: nftables.conf.j2
+      dest: /etc/nftables.conf
+      owner: root
+      mode: 0644
     notify:
       - restart nftables
       - restart fail2ban
 
   - name: Create /etc/nftables extra config directory
     when: ansible_distribution_major_version is version('11', '>=')
-    ansible.builtin.file: path=/etc/nftables state=directory owner=root mode=0755
+    ansible.builtin.file:
+      path: /etc/nftables
+      state: directory
+      owner: root
+      mode: 0755
 
   - name: Copy extra nftables configuration files
     when: ansible_distribution_major_version is version('11', '>=')
-    ansible.builtin.copy: src={{ item.src }} dest=/etc/nftables/{{ item.src }} owner=root group=root mode=0644 force={{ item.force }}
+    ansible.builtin.copy:
+      src: "{{ item.src }}"
+      dest: "/etc/nftables/{{ item.src }}"
+      owner: root
+      group: root
+      mode: 0644
+      force: "{{ item.force }}"
     loop:
       - { src: "spamhaus-ipv4.nft", force: "no" }
       - { src: "spamhaus-ipv6.nft", force: "no" }
@@ -43,9 +58,14 @@
       - restart nftables
       - restart fail2ban
 
-  - name: Copy Spamhaus nftables update scripts
+  - name: Copy nftables update scripts
     when: ansible_distribution_version is version('11', '>=')
-    ansible.builtin.copy: src={{ item }} dest=/usr/local/bin/{{ item }} mode=0755 owner=root group=root
+    ansible.builtin.copy:
+      src: "{{ item }}"
+      dest: "/usr/local/bin/{{ item }}"
+      mode: 0755
+      owner: root
+      group: root
     loop:
       - update-spamhaus-nftables.sh
       - aggregate-cidr-addresses.pl
@@ -53,7 +73,12 @@
 
   - name: Copy nftables systemd units
     when: ansible_distribution_version is version('11', '>=')
-    ansible.builtin.copy: src={{ item }} dest=/etc/systemd/system/{{ item }} mode=0644 owner=root group=root
+    ansible.builtin.copy:
+      src: "{{ item }}"
+      dest: "/etc/systemd/system/{{ item }}"
+      mode: 0644
+      owner: root
+      group: root
     loop:
       - update-spamhaus-nftables.service
       - update-spamhaus-nftables.timer
@@ -63,19 +88,26 @@
 
   # need to reload to pick up service/timer/environment changes
   - name: Reload systemd daemon
-    ansible.builtin.systemd: daemon_reload=true
+    ansible.builtin.systemd:
+      daemon_reload: true
     when: nftables_systemd_units is changed
 
   - name: Start and enable nftables update timers
     when: ansible_distribution_version is version('11', '>=')
-    ansible.builtin.systemd: name={{ item }} state=started enabled=true
+    ansible.builtin.systemd:
+      name: "{{ item }}"
+      state: started
+      enabled: true
     loop:
       - update-spamhaus-nftables.timer
       - update-abusech-nftables.timer
 
   - name: Start and enable nftables
     when: ansible_distribution_major_version is version('11', '>=')
-    ansible.builtin.systemd: name=nftables state=started enabled=true
+    ansible.builtin.systemd:
+      name: nftables
+      state: started
+      enabled: true
 
   - ansible.builtin.include_tasks: fail2ban.yml
     when: ansible_distribution_major_version is version('9', '>=')

roles/common/tasks/firewall_Ubuntu.yml

@@ -2,37 +2,50 @@
 # Ubuntu 20.04 will use nftables directly, with no firewalld.
 
 - block:
-  - name: Set Ubuntu firewall packages
+  - name: Install Ubuntu firewall packages
-    when: ansible_distribution_version is version('20.04', '>=')
+    ansible.builtin.package:
-    ansible.builtin.set_fact:
+      name:
-      ubuntu_firewall_packages:
         - fail2ban
         - libnet-ip-perl # for aggregate-cidr-addresses.pl
         - nftables
         - python3-systemd
         - curl # for nftables update scripts
-
+      state: present
-  - name: Install firewall packages
+      cache_valid_time: 3600
-    ansible.builtin.apt: pkg={{ ubuntu_firewall_packages }} state=present cache_valid_time=3600
 
   - name: Remove ufw
-    when: ansible_distribution_version is version('16.04', '>=')
+    ansible.builtin.package:
-    ansible.builtin.apt: pkg=ufw state=absent
+      name: ufw
+      state: absent
 
   - name: Copy nftables.conf
     when: ansible_distribution_version is version('20.04', '>=')
-    ansible.builtin.template: src=nftables.conf.j2 dest=/etc/nftables.conf owner=root mode=0644
+    ansible.builtin.template:
+      src: nftables.conf.j2
+      dest: /etc/nftables.conf
+      owner: root
+      mode: 0644
     notify:
       - restart nftables
       - restart fail2ban
 
   - name: Create /etc/nftables extra config directory
     when: ansible_distribution_version is version('20.04', '>=')
-    ansible.builtin.file: path=/etc/nftables state=directory owner=root mode=0755
+    ansible.builtin.file:
+      path: /etc/nftables
+      state: directory
+      owner: root
+      mode: 0755
 
   - name: Copy extra nftables configuration files
     when: ansible_distribution_version is version('20.04', '>=')
-    ansible.builtin.copy: src={{ item.src }} dest=/etc/nftables/{{ item.src }} owner=root group=root mode=0644 force={{ item.force }}
+    ansible.builtin.copy:
+      src: "{{ item.src }}"
+      dest: "/etc/nftables/{{ item.src }}"
+      owner: root
+      group: root
+      mode: 0644
+      force: "{{ item.force }}"
     loop:
       - { src: "spamhaus-ipv4.nft", force: "no" }
       - { src: "spamhaus-ipv6.nft", force: "no" }
@@ -45,7 +58,12 @@
 
   - name: Copy nftables update scripts
     when: ansible_distribution_version is version('20.04', '>=')
-    ansible.builtin.copy: src={{ item }} dest=/usr/local/bin/{{ item }} mode=0755 owner=root group=root
+    ansible.builtin.copy:
+      src: "{{ item }}"
+      dest: "/usr/local/bin/{{ item }}"
+      mode: 0755
+      owner: root
+      group: root
     loop:
       - update-spamhaus-nftables.sh
       - aggregate-cidr-addresses.pl
@@ -53,7 +71,12 @@
 
   - name: Copy nftables systemd units
     when: ansible_distribution_version is version('20.04', '>=')
-    ansible.builtin.copy: src={{ item }} dest=/etc/systemd/system/{{ item }} mode=0644 owner=root group=root
+    ansible.builtin.copy:
+      src: "{{ item }}"
+      dest: "/etc/systemd/system/{{ item }}"
+      mode: 0644
+      owner: root
+      group: root
     loop:
         - update-spamhaus-nftables.service
         - update-spamhaus-nftables.timer
@@ -63,19 +86,26 @@
 
   # need to reload to pick up service/timer/environment changes
   - name: Reload systemd daemon
-    ansible.builtin.systemd: daemon_reload=true
+    ansible.builtin.systemd:
+      daemon_reload: true
     when: nftables_systemd_units is changed
 
   - name: Start and enable nftables update timers
     when: ansible_distribution_version is version('20.04', '>=')
-    ansible.builtin.systemd: name={{ item }} state=started enabled=true
+    ansible.builtin.systemd:
+      name: "{{ item }}"
+      state: started
+      enabled: true
     loop:
       - update-spamhaus-nftables.timer
       - update-abusech-nftables.timer
 
   - name: Start and enable nftables
     when: ansible_distribution_version is version('20.04', '>=')
-    ansible.builtin.systemd: name=nftables state=started enabled=true
+    ansible.builtin.systemd:
+      name: nftables
+      state: started
+      enabled: true
 
   - ansible.builtin.include_tasks: fail2ban.yml
     when: ansible_distribution_version is version('16.04', '>=')