---

- block:
  - name: Install iptables 1.8.3 on Debian Buster
    when: ansible_distribution_major_version is version_compare('10', '==')
    apt: pkg=iptables state=present default_release=buster-backports update_cache=yes cache_valid_time=3600

  - name: Install firewalld and deps
    when: ansible_distribution_major_version is version_compare('8', '>=')
    apt: pkg={{ item }} state=present
    loop:
      - firewalld
      - tidy

  - name: Copy firewalld public zone file
    when: ansible_distribution_major_version is version_compare('8', '>=')
    template: src=public.xml.j2 dest=/etc/firewalld/zones/public.xml owner=root mode=0600

  - name: Format public.xml firewalld zone file
    when: ansible_distribution_major_version is version_compare('8', '>=')
    command: tidy -xml -iq -m -w 0 /etc/firewalld/zones/public.xml
    notify:
      - restart firewalld

  - name: Copy ipsets of abusive IPs
    when: ansible_distribution_major_version is version_compare('8', '>=')
    copy: src={{ item }} dest=/etc/firewalld/ipsets/{{ item }} owner=root group=root mode=0600
    loop:
      - abusers-ipv4.xml
      - abusers-ipv6.xml
    notify:
      - restart firewalld
  tags: firewall

# vim: set sw=2 ts=2: