Alan Orth
201165cff6
I have added cache_valid_time=3600 for the first task in each tag that could be possibly running apt-related commands. For ex, the "nginx" tag is also in the "packages" tag, but sometimes you run the nginx tag by itself (perhaps repeatadely), so you'd want to limit the update unless the cache was 1 hour old
36 lines
1.1 KiB
YAML
36 lines
1.1 KiB
YAML
---
|
|
- name: Install iptables-persistent
|
|
when: ansible_distribution_version == '14.04'
|
|
apt: pkg=iptables-persistent update_cache=yes cache_valid_time=3600
|
|
tags: packages
|
|
|
|
- name: Copy /etc/iptables/rules.v4
|
|
when: ansible_distribution_version == '14.04'
|
|
template: src=iptables.j2 dest=/etc/iptables/rules.v4 owner=root mode=0600
|
|
notify:
|
|
- restart iptables-persistent
|
|
|
|
- name: Copy /etc/iptables/rules.v6
|
|
when: ansible_distribution_version == '14.04'
|
|
template: src=ip6tables.j2 dest=/etc/iptables/rules.v6 owner=root group=root mode=0600
|
|
notify:
|
|
- restart iptables-persistent
|
|
|
|
- name: Install firewalld and deps
|
|
when: ansible_distribution_version >= '15.04'
|
|
apt: pkg={{ item }} state=latest
|
|
with_items:
|
|
- firewalld
|
|
- tidy
|
|
tags: packages
|
|
|
|
- name: Copy firewalld public zone file
|
|
when: ansible_distribution_version >= '15.04'
|
|
template: src=public.xml.j2 dest=/etc/firewalld/zones/public.xml owner=root mode=0600
|
|
|
|
- name: Format public.xml firewalld zone file
|
|
when: ansible_distribution_version >= '15.04'
|
|
shell: tidy -xml -iq -m -w 0 /etc/firewalld/zones/public.xml
|
|
notify:
|
|
- restart firewalld
|