---

- block:
  - name: Install firewalld and deps
    when: ansible_distribution_major_version is version_compare('8', '>=')
    apt: pkg={{ item }} state=present
    loop:
      - firewalld
      - tidy

  - name: Use nftables backend in firewalld
    when: ansible_distribution_major_version is version_compare('10', '>=')
    lineinfile:
      dest: /etc/firewalld/firewalld.conf
      regexp: '^FirewallBackend=iptables$'
      line: 'FirewallBackend=nftables'
    notify:
      - restart firewalld

# firewalld seems to have an issue with iptables 1.8.2 when using the nftables
# backend. Using individual calls seems to work around it.
# See: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931722
  - name: Use individual iptables calls
    when: ansible_distribution_major_version is version_compare('10', '>=')
    lineinfile:
      dest: /etc/firewalld/firewalld.conf
      regexp: '^IndividualCalls=no$'
      line: 'IndividualCalls=yes'
    notify:
      - restart firewalld

  - name: Copy firewalld public zone file
    when: ansible_distribution_major_version is version_compare('8', '>=')
    template: src=public.xml.j2 dest=/etc/firewalld/zones/public.xml owner=root mode=0600

  - name: Format public.xml firewalld zone file
    when: ansible_distribution_major_version is version_compare('8', '>=')
    command: tidy -xml -iq -m -w 0 /etc/firewalld/zones/public.xml
    notify:
      - restart firewalld

  - name: Copy ipsets of abusive IPs
    when: ansible_distribution_major_version is version_compare('8', '>=')
    copy: src={{ item }} dest=/etc/firewalld/ipsets/{{ item }} owner=root group=root mode=0600
    loop:
      - abusers-ipv4.xml
      - abusers-ipv6.xml
    notify:
      - restart firewalld
  tags: firewall

# vim: set sw=2 ts=2: