Alan Orth
9bba0d96bb
I will try using nftables directly instead of via firewalld as of Debian 11 as it is the replacement for the iptables/ipset stack in recent years and is easier to work with. This also includes a systemd service, timer, and script to update the spamhaus DROP lists as nftables sets. Still need to add fail2ban support.
21 lines
434 B
YAML
21 lines
434 B
YAML
---
|
|
# file: roles/common/handlers/main.yml
|
|
|
|
- name: reload sshd
|
|
systemd: name={{ sshd_service_name }} state=reloaded
|
|
|
|
- name: reload sysctl
|
|
command: sysctl -p /etc/sysctl.conf
|
|
|
|
- name: restart firewalld
|
|
systemd: name=firewalld state=restarted
|
|
|
|
- name: restart fail2ban
|
|
systemd: name=fail2ban state=restarted
|
|
|
|
- name: reload systemd
|
|
systemd: daemon_reload=yes
|
|
|
|
- name: reload nftables
|
|
systemd: name=nftables state=reloaded
|