diff --git a/roles/ensure_apache/meta/main.yml b/roles/ensure_apache/meta/main.yml index 6fb025b..932ca8d 100644 --- a/roles/ensure_apache/meta/main.yml +++ b/roles/ensure_apache/meta/main.yml @@ -45,6 +45,7 @@ galaxy_info: # # NOTE: A tag is limited to a single word comprised of alphanumeric characters. # Maximum 20 tags per role. -dependencies: [] +dependencies: + - role: ensure_firewalld # List your role dependencies here, one per line. Be sure to remove the '[]' above, # if you add dependencies to this list. diff --git a/roles/ensure_apache/tasks/main.yml b/roles/ensure_apache/tasks/main.yml index 97feddf..aa07b1c 100644 --- a/roles/ensure_apache/tasks/main.yml +++ b/roles/ensure_apache/tasks/main.yml @@ -119,13 +119,13 @@ - ansible_facts.packages["firewalld"] is defined - ansible_facts.packages["python3-firewall"] is defined - ensure_apache is defined - - ensure_apache.firewall_list is defined - - ensure_apache.firewall_list is iterable + - ensure_apache.firewalld_list is defined + - ensure_apache.firewalld_list is iterable ansible.posix.firewalld: permanent: '{{ item.permanent }}' service: '{{ item.service }}' state: '{{ item.state }}' - loop: '{{ ensure_apache.firewall_list }}' + loop: '{{ ensure_apache.firewalld_list }}' loop_control: label: '{{ item.service }} will be {{ item.state }}' notify: diff --git a/roles/ensure_apache/vars/Fedora-42-default.yml b/roles/ensure_apache/vars/Fedora-42-default.yml index 08cfae1..0a3856c 100644 --- a/roles/ensure_apache/vars/Fedora-42-default.yml +++ b/roles/ensure_apache/vars/Fedora-42-default.yml @@ -33,7 +33,7 @@ package_list: state: present - name: php-xml state: present -firewall_list: +firewalld_list: - permanent: 'yes' service: http state: enabled diff --git a/roles/ensure_apache/vars/Fedora-43-default.yml b/roles/ensure_apache/vars/Fedora-43-default.yml index 08cfae1..0a3856c 100644 --- a/roles/ensure_apache/vars/Fedora-43-default.yml +++ b/roles/ensure_apache/vars/Fedora-43-default.yml @@ -33,7 +33,7 @@ package_list: state: present - name: php-xml state: present -firewall_list: +firewalld_list: - permanent: 'yes' service: http state: enabled diff --git a/roles/ensure_apache/vars/Fedora-44-default.yml b/roles/ensure_apache/vars/Fedora-44-default.yml index de518de..35c67b0 100644 --- a/roles/ensure_apache/vars/Fedora-44-default.yml +++ b/roles/ensure_apache/vars/Fedora-44-default.yml @@ -33,7 +33,7 @@ package_list: state: present - name: php-xml state: present -firewall_list: +firewalld_list: - permanent: 'yes' service: http state: enabled diff --git a/roles/ensure_cockpit/meta/main.yml b/roles/ensure_cockpit/meta/main.yml index f223a38..b9c3869 100644 --- a/roles/ensure_cockpit/meta/main.yml +++ b/roles/ensure_cockpit/meta/main.yml @@ -45,6 +45,7 @@ galaxy_info: # # NOTE: A tag is limited to a single word comprised of alphanumeric characters. # Maximum 20 tags per role. -dependencies: [] +dependencies: + - role: ensure_firewalld # List your role dependencies here, one per line. Be sure to remove the '[]' above, # if you add dependencies to this list. diff --git a/roles/ensure_cockpit/tasks/main.yml b/roles/ensure_cockpit/tasks/main.yml index b842021..827c350 100644 --- a/roles/ensure_cockpit/tasks/main.yml +++ b/roles/ensure_cockpit/tasks/main.yml @@ -83,5 +83,20 @@ loop_control: label: '{{ item.name }} will be {{ item.state }}' notify: [ensure_cockpit.package_facts, ensure_cockpit.service_facts] +- name: ensure firewall + when: + - ansible_facts["system"] == 'Linux' + - ansible_facts.packages["firewalld"] is defined + - ansible_facts.packages["python3-firewall"] is defined + - ensure_cockpit is defined + - ensure_cockpit.firewalld_list is defined + - ensure_cockpit.firewalld_list is iterable + ansible.posix.firewalld: + permanent: '{{ item.permanent }}' + service: '{{ item.service }}' + state: '{{ item.state }}' + loop: '{{ ensure_cockpit.firewalld_list }}' + loop_control: + label: '{{ item.service }} will be {{ item.state }}' - name: flush handlers ansible.builtin.meta: flush_handlers diff --git a/roles/ensure_cockpit/vars/AlmaLinux-10-default.yml b/roles/ensure_cockpit/vars/AlmaLinux-10-default.yml index 35e7233..a9fdc0a 100644 --- a/roles/ensure_cockpit/vars/AlmaLinux-10-default.yml +++ b/roles/ensure_cockpit/vars/AlmaLinux-10-default.yml @@ -21,3 +21,8 @@ service_list: - name: cockpit.socket state: started enabled: 'yes' + +firewalld_list: + - permanent: "yes" + service: cockpit + state: enabled diff --git a/roles/ensure_cockpit/vars/AlmaLinux-9-default.yml b/roles/ensure_cockpit/vars/AlmaLinux-9-default.yml index 35e7233..a9fdc0a 100644 --- a/roles/ensure_cockpit/vars/AlmaLinux-9-default.yml +++ b/roles/ensure_cockpit/vars/AlmaLinux-9-default.yml @@ -21,3 +21,8 @@ service_list: - name: cockpit.socket state: started enabled: 'yes' + +firewalld_list: + - permanent: "yes" + service: cockpit + state: enabled diff --git a/roles/ensure_cockpit/vars/CentOS-10-default.yml b/roles/ensure_cockpit/vars/CentOS-10-default.yml index 35e7233..a9fdc0a 100644 --- a/roles/ensure_cockpit/vars/CentOS-10-default.yml +++ b/roles/ensure_cockpit/vars/CentOS-10-default.yml @@ -21,3 +21,8 @@ service_list: - name: cockpit.socket state: started enabled: 'yes' + +firewalld_list: + - permanent: "yes" + service: cockpit + state: enabled diff --git a/roles/ensure_cockpit/vars/CentOS-9-default.yml b/roles/ensure_cockpit/vars/CentOS-9-default.yml index 35e7233..a9fdc0a 100644 --- a/roles/ensure_cockpit/vars/CentOS-9-default.yml +++ b/roles/ensure_cockpit/vars/CentOS-9-default.yml @@ -21,3 +21,8 @@ service_list: - name: cockpit.socket state: started enabled: 'yes' + +firewalld_list: + - permanent: "yes" + service: cockpit + state: enabled diff --git a/roles/ensure_cockpit/vars/Debian-11-default.yml b/roles/ensure_cockpit/vars/Debian-11-default.yml index 26b92b9..10c8c3a 100644 --- a/roles/ensure_cockpit/vars/Debian-11-default.yml +++ b/roles/ensure_cockpit/vars/Debian-11-default.yml @@ -21,3 +21,8 @@ service_list: - name: cockpit.socket state: started enabled: 'yes' + +firewalld_list: + - permanent: "yes" + service: cockpit + state: enabled diff --git a/roles/ensure_cockpit/vars/Debian-12-default.yml b/roles/ensure_cockpit/vars/Debian-12-default.yml index d85b220..5166313 100644 --- a/roles/ensure_cockpit/vars/Debian-12-default.yml +++ b/roles/ensure_cockpit/vars/Debian-12-default.yml @@ -23,3 +23,8 @@ service_list: - name: cockpit.socket state: started enabled: 'yes' + +firewalld_list: + - permanent: "yes" + service: cockpit + state: enabled diff --git a/roles/ensure_cockpit/vars/Debian-13-default.yml b/roles/ensure_cockpit/vars/Debian-13-default.yml index d85b220..5166313 100644 --- a/roles/ensure_cockpit/vars/Debian-13-default.yml +++ b/roles/ensure_cockpit/vars/Debian-13-default.yml @@ -23,3 +23,8 @@ service_list: - name: cockpit.socket state: started enabled: 'yes' + +firewalld_list: + - permanent: "yes" + service: cockpit + state: enabled diff --git a/roles/ensure_cockpit/vars/Fedora-42-default.yml b/roles/ensure_cockpit/vars/Fedora-42-default.yml index 6b43c9d..caab19e 100644 --- a/roles/ensure_cockpit/vars/Fedora-42-default.yml +++ b/roles/ensure_cockpit/vars/Fedora-42-default.yml @@ -27,3 +27,8 @@ service_list: - name: cockpit.socket state: started enabled: 'yes' + +firewalld_list: + - permanent: "yes" + service: cockpit + state: enabled diff --git a/roles/ensure_cockpit/vars/Fedora-43-default.yml b/roles/ensure_cockpit/vars/Fedora-43-default.yml index 6b43c9d..caab19e 100644 --- a/roles/ensure_cockpit/vars/Fedora-43-default.yml +++ b/roles/ensure_cockpit/vars/Fedora-43-default.yml @@ -27,3 +27,8 @@ service_list: - name: cockpit.socket state: started enabled: 'yes' + +firewalld_list: + - permanent: "yes" + service: cockpit + state: enabled diff --git a/roles/ensure_cockpit/vars/Fedora-44-default.yml b/roles/ensure_cockpit/vars/Fedora-44-default.yml index 6b43c9d..caab19e 100644 --- a/roles/ensure_cockpit/vars/Fedora-44-default.yml +++ b/roles/ensure_cockpit/vars/Fedora-44-default.yml @@ -27,3 +27,8 @@ service_list: - name: cockpit.socket state: started enabled: 'yes' + +firewalld_list: + - permanent: "yes" + service: cockpit + state: enabled diff --git a/roles/ensure_cockpit/vars/OracleLinux-10-default.yml b/roles/ensure_cockpit/vars/OracleLinux-10-default.yml index 35e7233..a9fdc0a 100644 --- a/roles/ensure_cockpit/vars/OracleLinux-10-default.yml +++ b/roles/ensure_cockpit/vars/OracleLinux-10-default.yml @@ -21,3 +21,8 @@ service_list: - name: cockpit.socket state: started enabled: 'yes' + +firewalld_list: + - permanent: "yes" + service: cockpit + state: enabled diff --git a/roles/ensure_cockpit/vars/OracleLinux-9-default.yml b/roles/ensure_cockpit/vars/OracleLinux-9-default.yml index 35e7233..a9fdc0a 100644 --- a/roles/ensure_cockpit/vars/OracleLinux-9-default.yml +++ b/roles/ensure_cockpit/vars/OracleLinux-9-default.yml @@ -21,3 +21,8 @@ service_list: - name: cockpit.socket state: started enabled: 'yes' + +firewalld_list: + - permanent: "yes" + service: cockpit + state: enabled diff --git a/roles/ensure_cockpit/vars/Rocky-10-default.yml b/roles/ensure_cockpit/vars/Rocky-10-default.yml index 35e7233..a9fdc0a 100644 --- a/roles/ensure_cockpit/vars/Rocky-10-default.yml +++ b/roles/ensure_cockpit/vars/Rocky-10-default.yml @@ -21,3 +21,8 @@ service_list: - name: cockpit.socket state: started enabled: 'yes' + +firewalld_list: + - permanent: "yes" + service: cockpit + state: enabled diff --git a/roles/ensure_cockpit/vars/Rocky-9-default.yml b/roles/ensure_cockpit/vars/Rocky-9-default.yml index 35e7233..a9fdc0a 100644 --- a/roles/ensure_cockpit/vars/Rocky-9-default.yml +++ b/roles/ensure_cockpit/vars/Rocky-9-default.yml @@ -21,3 +21,8 @@ service_list: - name: cockpit.socket state: started enabled: 'yes' + +firewalld_list: + - permanent: "yes" + service: cockpit + state: enabled diff --git a/roles/ensure_cockpit/vars/Ubuntu-22-default.yml b/roles/ensure_cockpit/vars/Ubuntu-22-default.yml index d85b220..5166313 100644 --- a/roles/ensure_cockpit/vars/Ubuntu-22-default.yml +++ b/roles/ensure_cockpit/vars/Ubuntu-22-default.yml @@ -23,3 +23,8 @@ service_list: - name: cockpit.socket state: started enabled: 'yes' + +firewalld_list: + - permanent: "yes" + service: cockpit + state: enabled diff --git a/roles/ensure_cockpit/vars/Ubuntu-24-default.yml b/roles/ensure_cockpit/vars/Ubuntu-24-default.yml index d85b220..5166313 100644 --- a/roles/ensure_cockpit/vars/Ubuntu-24-default.yml +++ b/roles/ensure_cockpit/vars/Ubuntu-24-default.yml @@ -23,3 +23,8 @@ service_list: - name: cockpit.socket state: started enabled: 'yes' + +firewalld_list: + - permanent: "yes" + service: cockpit + state: enabled diff --git a/roles/ensure_cockpit/vars/Ubuntu-26-default.yml b/roles/ensure_cockpit/vars/Ubuntu-26-default.yml index d85b220..5166313 100644 --- a/roles/ensure_cockpit/vars/Ubuntu-26-default.yml +++ b/roles/ensure_cockpit/vars/Ubuntu-26-default.yml @@ -23,3 +23,8 @@ service_list: - name: cockpit.socket state: started enabled: 'yes' + +firewalld_list: + - permanent: "yes" + service: cockpit + state: enabled diff --git a/roles/ensure_dovecot/meta/main.yml b/roles/ensure_dovecot/meta/main.yml index 9fc0b95..fa98cd5 100644 --- a/roles/ensure_dovecot/meta/main.yml +++ b/roles/ensure_dovecot/meta/main.yml @@ -45,6 +45,7 @@ galaxy_info: # # NOTE: A tag is limited to a single word comprised of alphanumeric characters. # Maximum 20 tags per role. -dependencies: [] +dependencies: + - role: ensure_firewalld # List your role dependencies here, one per line. Be sure to remove the '[]' above, # if you add dependencies to this list. diff --git a/roles/ensure_dovecot/tasks/main.yml b/roles/ensure_dovecot/tasks/main.yml index 840a589..4428c49 100644 --- a/roles/ensure_dovecot/tasks/main.yml +++ b/roles/ensure_dovecot/tasks/main.yml @@ -118,13 +118,13 @@ - ansible_facts.packages["firewalld"] is defined - ansible_facts.packages["python3-firewall"] is defined - ensure_dovecot is defined - - ensure_dovecot.firewall_list is defined - - ensure_dovecot.firewall_list is iterable + - ensure_dovecot.firewalld_list is defined + - ensure_dovecot.firewalld_list is iterable ansible.posix.firewalld: permanent: '{{ item.permanent }}' service: '{{ item.service }}' state: '{{ item.state }}' - loop: '{{ ensure_dovecot.firewall_list }}' + loop: '{{ ensure_dovecot.firewalld_list }}' loop_control: label: '{{ item.service }} will be {{ item.state }}' notify: diff --git a/roles/ensure_dovecot/vars/Fedora-42-default.yml b/roles/ensure_dovecot/vars/Fedora-42-default.yml index 6c94576..5e4847c 100644 --- a/roles/ensure_dovecot/vars/Fedora-42-default.yml +++ b/roles/ensure_dovecot/vars/Fedora-42-default.yml @@ -9,7 +9,7 @@ package_list: state: present - name: dovecot-pigeonhole state: present -firewall_list: +firewalld_list: - permanent: 'yes' service: imap state: enabled diff --git a/roles/ensure_dovecot/vars/Fedora-43-default.yml b/roles/ensure_dovecot/vars/Fedora-43-default.yml index 3089e5d..d8405b7 100644 --- a/roles/ensure_dovecot/vars/Fedora-43-default.yml +++ b/roles/ensure_dovecot/vars/Fedora-43-default.yml @@ -9,7 +9,7 @@ package_list: state: present - name: dovecot-pigeonhole state: present -firewall_list: +firewalld_list: - permanent: 'yes' service: imap state: enabled diff --git a/roles/ensure_dovecot/vars/Fedora-44-default.yml b/roles/ensure_dovecot/vars/Fedora-44-default.yml index 3089e5d..d8405b7 100644 --- a/roles/ensure_dovecot/vars/Fedora-44-default.yml +++ b/roles/ensure_dovecot/vars/Fedora-44-default.yml @@ -9,7 +9,7 @@ package_list: state: present - name: dovecot-pigeonhole state: present -firewall_list: +firewalld_list: - permanent: 'yes' service: imap state: enabled diff --git a/roles/ensure_fail2ban/meta/main.yml b/roles/ensure_fail2ban/meta/main.yml index 446d07e..1944c67 100644 --- a/roles/ensure_fail2ban/meta/main.yml +++ b/roles/ensure_fail2ban/meta/main.yml @@ -1,3 +1,4 @@ --- dependencies: + - role: ensure_firewalld - role: ensure_os_patch diff --git a/roles/ensure_firewalld/README.md b/roles/ensure_firewalld/README.md new file mode 100644 index 0000000..225dd44 --- /dev/null +++ b/roles/ensure_firewalld/README.md @@ -0,0 +1,38 @@ +Role Name +========= + +A brief description of the role goes here. + +Requirements +------------ + +Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required. + +Role Variables +-------------- + +A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. + +Dependencies +------------ + +A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. + +Example Playbook +---------------- + +Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: + + - hosts: servers + roles: + - { role: username.rolename, x: 42 } + +License +------- + +BSD + +Author Information +------------------ + +An optional section for the role authors to include contact information, or a website (HTML is not allowed). diff --git a/roles/ensure_firewalld/defaults/main.yml b/roles/ensure_firewalld/defaults/main.yml new file mode 100644 index 0000000..90760f6 --- /dev/null +++ b/roles/ensure_firewalld/defaults/main.yml @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +--- +# defaults file for ensure_firewalld diff --git a/roles/ensure_firewalld/handlers/main.yml b/roles/ensure_firewalld/handlers/main.yml new file mode 100644 index 0000000..8494a1a --- /dev/null +++ b/roles/ensure_firewalld/handlers/main.yml @@ -0,0 +1,7 @@ +--- +# handlers file for ensure_firewalld +- name: ensure_firewalld.package_facts + ansible.builtin.package_facts: + +- name: ensure_firewalld.service_facts + ansible.builtin.service_facts: diff --git a/roles/ensure_firewalld/meta/main.yml b/roles/ensure_firewalld/meta/main.yml new file mode 100644 index 0000000..15e1f8f --- /dev/null +++ b/roles/ensure_firewalld/meta/main.yml @@ -0,0 +1,9 @@ +--- +galaxy_info: + author: Jason Rothstein + description: Ensures firewalld is installed, running, and functional + company: your company (optional) + license: LGPL-3.0-or-later + min_ansible_version: 2.9 + galaxy_tags: [] +dependencies: [] diff --git a/roles/ensure_firewalld/tasks/main.yml b/roles/ensure_firewalld/tasks/main.yml new file mode 100644 index 0000000..d3ada17 --- /dev/null +++ b/roles/ensure_firewalld/tasks/main.yml @@ -0,0 +1,82 @@ +--- +# tasks file for ensure_firewalld +- name: include variables + when: ["ansible_facts[\"system\"] == 'Linux'"] + ansible.builtin.include_vars: + file: '{{ lookup("first_found", findme) }}' + name: ensure_firewalld + vars: + findme: + files: + - '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"] }}-{{ ansible_facts["architecture"] }}.yml' + - '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"] }}-default.yml' + - '{{ ansible_facts["distribution"] }}-default.yml' + - '{{ ansible_facts["os_family"] }}-{{ ansible_facts["distribution_major_version"] }}-{{ ansible_facts["architecture"] }}.yml' + - '{{ ansible_facts["os_family"] }}-{{ ansible_facts["distribution_major_version"] }}-default.yml' + - '{{ ansible_facts["os_family"] }}-default.yml' + - default.yml + paths: [../vars/] + errors: ignore + +- name: package discovery + when: + - ansible_facts["system"] == 'Linux' + - ansible_facts["packages"] is not defined + ansible.builtin.package_facts: + +- name: service discovery + when: + - ansible_facts["system"] == 'Linux' + - ansible_facts["services"] is not defined + ansible.builtin.service_facts: + +- name: ensure packages + when: + - ansible_facts["system"] == 'Linux' + - ensure_firewalld is defined + - ensure_firewalld.package_list is defined + - ensure_firewalld.package_list is iterable + ansible.builtin.package: + name: '{{ item.name }}' + state: '{{ item.state }}' + loop: '{{ ensure_firewalld.package_list }}' + loop_control: + label: '{{ item.name }} will be {{ item.state }}' + notify: [ensure_firewalld.package_facts, ensure_firewalld.service_facts] + +- name: ensure services + when: + - ansible_facts["system"] == 'Linux' + - ensure_firewalld is defined + - ensure_firewalld.service_list is defined + - ensure_firewalld.service_list is iterable + ansible.builtin.service: + enabled: '{{ item.enabled }}' + name: '{{ item.name }}' + state: '{{ item.state }}' + loop: '{{ ensure_firewalld.service_list }}' + loop_control: + label: '{{ item.name }} will be {{ item.state }}' + notify: [ensure_firewalld.package_facts, ensure_firewalld.service_facts] + +- name: force handlers to run for firewalld + ansible.builtin.meta: flush_handlers + +- name: ensure default firewall rules + when: + - ansible_facts["system"] == 'Linux' + - ansible_facts.packages["firewalld"] is defined + - ansible_facts.packages["python3-firewall"] is defined + - ensure_firewalld is defined + - ensure_firewalld.firewalld_list is defined + - ensure_firewalld.firewalld_list is iterable + ansible.posix.firewalld: + permanent: '{{ item.permanent }}' + service: '{{ item.service }}' + state: '{{ item.state }}' + loop: '{{ ensure_firewalld.firewalld_list }}' + loop_control: + label: '{{ item.service }} will be {{ item.state }}' + +- name: flush handlers + ansible.builtin.meta: flush_handlers diff --git a/roles/ensure_firewalld/tests/inventory b/roles/ensure_firewalld/tests/inventory new file mode 100644 index 0000000..03ca42f --- /dev/null +++ b/roles/ensure_firewalld/tests/inventory @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +localhost + diff --git a/roles/ensure_firewalld/tests/test.yml b/roles/ensure_firewalld/tests/test.yml new file mode 100644 index 0000000..af1346c --- /dev/null +++ b/roles/ensure_firewalld/tests/test.yml @@ -0,0 +1,6 @@ +#SPDX-License-Identifier: MIT-0 +--- +- hosts: localhost + remote_user: root + roles: + - ensure_firewalld diff --git a/roles/ensure_firewalld/vars/AlmaLinux-10-default.yml b/roles/ensure_firewalld/vars/AlmaLinux-10-default.yml new file mode 100644 index 0000000..31d04f9 --- /dev/null +++ b/roles/ensure_firewalld/vars/AlmaLinux-10-default.yml @@ -0,0 +1,15 @@ +--- +# vars file for ensure_firewalld +package_list: + - name: firewalld + state: present + - name: python3-firewall + state: present +service_list: + - name: firewalld.service + state: started + enabled: 'yes' +firewalld_list: + - permanent: 'yes' + service: ssh + state: enabled diff --git a/roles/ensure_firewalld/vars/AlmaLinux-9-default.yml b/roles/ensure_firewalld/vars/AlmaLinux-9-default.yml new file mode 100644 index 0000000..31d04f9 --- /dev/null +++ b/roles/ensure_firewalld/vars/AlmaLinux-9-default.yml @@ -0,0 +1,15 @@ +--- +# vars file for ensure_firewalld +package_list: + - name: firewalld + state: present + - name: python3-firewall + state: present +service_list: + - name: firewalld.service + state: started + enabled: 'yes' +firewalld_list: + - permanent: 'yes' + service: ssh + state: enabled diff --git a/roles/ensure_firewalld/vars/CentOS-10-default.yml b/roles/ensure_firewalld/vars/CentOS-10-default.yml new file mode 100644 index 0000000..31d04f9 --- /dev/null +++ b/roles/ensure_firewalld/vars/CentOS-10-default.yml @@ -0,0 +1,15 @@ +--- +# vars file for ensure_firewalld +package_list: + - name: firewalld + state: present + - name: python3-firewall + state: present +service_list: + - name: firewalld.service + state: started + enabled: 'yes' +firewalld_list: + - permanent: 'yes' + service: ssh + state: enabled diff --git a/roles/ensure_firewalld/vars/CentOS-9-default.yml b/roles/ensure_firewalld/vars/CentOS-9-default.yml new file mode 100644 index 0000000..31d04f9 --- /dev/null +++ b/roles/ensure_firewalld/vars/CentOS-9-default.yml @@ -0,0 +1,15 @@ +--- +# vars file for ensure_firewalld +package_list: + - name: firewalld + state: present + - name: python3-firewall + state: present +service_list: + - name: firewalld.service + state: started + enabled: 'yes' +firewalld_list: + - permanent: 'yes' + service: ssh + state: enabled diff --git a/roles/ensure_firewalld/vars/Debian-11-default.yml b/roles/ensure_firewalld/vars/Debian-11-default.yml new file mode 100644 index 0000000..31d04f9 --- /dev/null +++ b/roles/ensure_firewalld/vars/Debian-11-default.yml @@ -0,0 +1,15 @@ +--- +# vars file for ensure_firewalld +package_list: + - name: firewalld + state: present + - name: python3-firewall + state: present +service_list: + - name: firewalld.service + state: started + enabled: 'yes' +firewalld_list: + - permanent: 'yes' + service: ssh + state: enabled diff --git a/roles/ensure_firewalld/vars/Debian-12-default.yml b/roles/ensure_firewalld/vars/Debian-12-default.yml new file mode 100644 index 0000000..31d04f9 --- /dev/null +++ b/roles/ensure_firewalld/vars/Debian-12-default.yml @@ -0,0 +1,15 @@ +--- +# vars file for ensure_firewalld +package_list: + - name: firewalld + state: present + - name: python3-firewall + state: present +service_list: + - name: firewalld.service + state: started + enabled: 'yes' +firewalld_list: + - permanent: 'yes' + service: ssh + state: enabled diff --git a/roles/ensure_firewalld/vars/Debian-13-default.yml b/roles/ensure_firewalld/vars/Debian-13-default.yml new file mode 100644 index 0000000..31d04f9 --- /dev/null +++ b/roles/ensure_firewalld/vars/Debian-13-default.yml @@ -0,0 +1,15 @@ +--- +# vars file for ensure_firewalld +package_list: + - name: firewalld + state: present + - name: python3-firewall + state: present +service_list: + - name: firewalld.service + state: started + enabled: 'yes' +firewalld_list: + - permanent: 'yes' + service: ssh + state: enabled diff --git a/roles/ensure_firewalld/vars/Fedora-42-default.yml b/roles/ensure_firewalld/vars/Fedora-42-default.yml new file mode 100644 index 0000000..31d04f9 --- /dev/null +++ b/roles/ensure_firewalld/vars/Fedora-42-default.yml @@ -0,0 +1,15 @@ +--- +# vars file for ensure_firewalld +package_list: + - name: firewalld + state: present + - name: python3-firewall + state: present +service_list: + - name: firewalld.service + state: started + enabled: 'yes' +firewalld_list: + - permanent: 'yes' + service: ssh + state: enabled diff --git a/roles/ensure_firewalld/vars/Fedora-43-default.yml b/roles/ensure_firewalld/vars/Fedora-43-default.yml new file mode 100644 index 0000000..31d04f9 --- /dev/null +++ b/roles/ensure_firewalld/vars/Fedora-43-default.yml @@ -0,0 +1,15 @@ +--- +# vars file for ensure_firewalld +package_list: + - name: firewalld + state: present + - name: python3-firewall + state: present +service_list: + - name: firewalld.service + state: started + enabled: 'yes' +firewalld_list: + - permanent: 'yes' + service: ssh + state: enabled diff --git a/roles/ensure_firewalld/vars/Fedora-44-default.yml b/roles/ensure_firewalld/vars/Fedora-44-default.yml new file mode 100644 index 0000000..31d04f9 --- /dev/null +++ b/roles/ensure_firewalld/vars/Fedora-44-default.yml @@ -0,0 +1,15 @@ +--- +# vars file for ensure_firewalld +package_list: + - name: firewalld + state: present + - name: python3-firewall + state: present +service_list: + - name: firewalld.service + state: started + enabled: 'yes' +firewalld_list: + - permanent: 'yes' + service: ssh + state: enabled diff --git a/roles/ensure_firewalld/vars/OracleLinux-10-default.yml b/roles/ensure_firewalld/vars/OracleLinux-10-default.yml new file mode 100644 index 0000000..31d04f9 --- /dev/null +++ b/roles/ensure_firewalld/vars/OracleLinux-10-default.yml @@ -0,0 +1,15 @@ +--- +# vars file for ensure_firewalld +package_list: + - name: firewalld + state: present + - name: python3-firewall + state: present +service_list: + - name: firewalld.service + state: started + enabled: 'yes' +firewalld_list: + - permanent: 'yes' + service: ssh + state: enabled diff --git a/roles/ensure_firewalld/vars/OracleLinux-9-default.yml b/roles/ensure_firewalld/vars/OracleLinux-9-default.yml new file mode 100644 index 0000000..31d04f9 --- /dev/null +++ b/roles/ensure_firewalld/vars/OracleLinux-9-default.yml @@ -0,0 +1,15 @@ +--- +# vars file for ensure_firewalld +package_list: + - name: firewalld + state: present + - name: python3-firewall + state: present +service_list: + - name: firewalld.service + state: started + enabled: 'yes' +firewalld_list: + - permanent: 'yes' + service: ssh + state: enabled diff --git a/roles/ensure_firewalld/vars/Rocky-10-default.yml b/roles/ensure_firewalld/vars/Rocky-10-default.yml new file mode 100644 index 0000000..31d04f9 --- /dev/null +++ b/roles/ensure_firewalld/vars/Rocky-10-default.yml @@ -0,0 +1,15 @@ +--- +# vars file for ensure_firewalld +package_list: + - name: firewalld + state: present + - name: python3-firewall + state: present +service_list: + - name: firewalld.service + state: started + enabled: 'yes' +firewalld_list: + - permanent: 'yes' + service: ssh + state: enabled diff --git a/roles/ensure_firewalld/vars/Rocky-9-default.yml b/roles/ensure_firewalld/vars/Rocky-9-default.yml new file mode 100644 index 0000000..31d04f9 --- /dev/null +++ b/roles/ensure_firewalld/vars/Rocky-9-default.yml @@ -0,0 +1,15 @@ +--- +# vars file for ensure_firewalld +package_list: + - name: firewalld + state: present + - name: python3-firewall + state: present +service_list: + - name: firewalld.service + state: started + enabled: 'yes' +firewalld_list: + - permanent: 'yes' + service: ssh + state: enabled diff --git a/roles/ensure_firewalld/vars/Ubuntu-22-default.yml b/roles/ensure_firewalld/vars/Ubuntu-22-default.yml new file mode 100644 index 0000000..31d04f9 --- /dev/null +++ b/roles/ensure_firewalld/vars/Ubuntu-22-default.yml @@ -0,0 +1,15 @@ +--- +# vars file for ensure_firewalld +package_list: + - name: firewalld + state: present + - name: python3-firewall + state: present +service_list: + - name: firewalld.service + state: started + enabled: 'yes' +firewalld_list: + - permanent: 'yes' + service: ssh + state: enabled diff --git a/roles/ensure_firewalld/vars/Ubuntu-24-default.yml b/roles/ensure_firewalld/vars/Ubuntu-24-default.yml new file mode 100644 index 0000000..31d04f9 --- /dev/null +++ b/roles/ensure_firewalld/vars/Ubuntu-24-default.yml @@ -0,0 +1,15 @@ +--- +# vars file for ensure_firewalld +package_list: + - name: firewalld + state: present + - name: python3-firewall + state: present +service_list: + - name: firewalld.service + state: started + enabled: 'yes' +firewalld_list: + - permanent: 'yes' + service: ssh + state: enabled diff --git a/roles/ensure_firewalld/vars/Ubuntu-26-default.yml b/roles/ensure_firewalld/vars/Ubuntu-26-default.yml new file mode 100644 index 0000000..31d04f9 --- /dev/null +++ b/roles/ensure_firewalld/vars/Ubuntu-26-default.yml @@ -0,0 +1,15 @@ +--- +# vars file for ensure_firewalld +package_list: + - name: firewalld + state: present + - name: python3-firewall + state: present +service_list: + - name: firewalld.service + state: started + enabled: 'yes' +firewalld_list: + - permanent: 'yes' + service: ssh + state: enabled diff --git a/roles/ensure_firewalld/vars/default.yml b/roles/ensure_firewalld/vars/default.yml new file mode 100644 index 0000000..91da2a7 --- /dev/null +++ b/roles/ensure_firewalld/vars/default.yml @@ -0,0 +1,2 @@ +--- +... diff --git a/roles/ensure_firewalld/vars/main.yml b/roles/ensure_firewalld/vars/main.yml new file mode 100644 index 0000000..91da2a7 --- /dev/null +++ b/roles/ensure_firewalld/vars/main.yml @@ -0,0 +1,2 @@ +--- +... diff --git a/roles/ensure_gitea/meta/main.yml b/roles/ensure_gitea/meta/main.yml index 44682e9..69e2998 100644 --- a/roles/ensure_gitea/meta/main.yml +++ b/roles/ensure_gitea/meta/main.yml @@ -45,6 +45,7 @@ galaxy_info: # # NOTE: A tag is limited to a single word comprised of alphanumeric characters. # Maximum 20 tags per role. -dependencies: [] +dependencies: + - role: ensure_firewalld # List your role dependencies here, one per line. Be sure to remove the '[]' above, # if you add dependencies to this list. diff --git a/roles/ensure_gitea/tasks/main.yml b/roles/ensure_gitea/tasks/main.yml index 96bdfcc..1cb908b 100644 --- a/roles/ensure_gitea/tasks/main.yml +++ b/roles/ensure_gitea/tasks/main.yml @@ -181,13 +181,13 @@ - ansible_facts.packages["firewalld"] is defined - ansible_facts.packages["python3-firewall"] is defined - ensure_gitea is defined - - ensure_gitea.firewall_list is defined - - ensure_gitea.firewall_list is iterable + - ensure_gitea.firewalld_list is defined + - ensure_gitea.firewalld_list is iterable ansible.posix.firewalld: permanent: '{{ item.permanent }}' service: '{{ item.service }}' state: '{{ item.state }}' - loop: '{{ ensure_gitea.firewall_list }}' + loop: '{{ ensure_gitea.firewalld_list }}' loop_control: label: '{{ item.service }} will be {{ item.state }}' notify: diff --git a/roles/ensure_mariadb/meta/main.yml b/roles/ensure_mariadb/meta/main.yml index 44682e9..69e2998 100644 --- a/roles/ensure_mariadb/meta/main.yml +++ b/roles/ensure_mariadb/meta/main.yml @@ -45,6 +45,7 @@ galaxy_info: # # NOTE: A tag is limited to a single word comprised of alphanumeric characters. # Maximum 20 tags per role. -dependencies: [] +dependencies: + - role: ensure_firewalld # List your role dependencies here, one per line. Be sure to remove the '[]' above, # if you add dependencies to this list. diff --git a/roles/ensure_mariadb/tasks/main.yml b/roles/ensure_mariadb/tasks/main.yml index 758f521..f385242 100644 --- a/roles/ensure_mariadb/tasks/main.yml +++ b/roles/ensure_mariadb/tasks/main.yml @@ -118,13 +118,13 @@ - ansible_facts.packages["firewalld"] is defined - ansible_facts.packages["python3-firewall"] is defined - ensure_mariadb is defined - - ensure_mariadb.firewall_list is defined - - ensure_mariadb.firewall_list is iterable + - ensure_mariadb.firewalld_list is defined + - ensure_mariadb.firewalld_list is iterable ansible.posix.firewalld: permanent: '{{ item.permanent }}' service: '{{ item.service }}' state: '{{ item.state }}' - loop: '{{ ensure_mariadb.firewall_list }}' + loop: '{{ ensure_mariadb.firewalld_list }}' loop_control: label: '{{ item.service }} will be {{ item.state }}' notify: diff --git a/roles/ensure_mariadb/vars/Fedora-42-default.yml b/roles/ensure_mariadb/vars/Fedora-42-default.yml index 22a9de3..fd6d30b 100644 --- a/roles/ensure_mariadb/vars/Fedora-42-default.yml +++ b/roles/ensure_mariadb/vars/Fedora-42-default.yml @@ -9,7 +9,7 @@ package_list: state: present - name: python3-PyMySQL state: present -firewall_list: +firewalld_list: - permanent: 'yes' service: mysql state: enabled diff --git a/roles/ensure_mariadb/vars/Fedora-43-default.yml b/roles/ensure_mariadb/vars/Fedora-43-default.yml index 22a9de3..fd6d30b 100644 --- a/roles/ensure_mariadb/vars/Fedora-43-default.yml +++ b/roles/ensure_mariadb/vars/Fedora-43-default.yml @@ -9,7 +9,7 @@ package_list: state: present - name: python3-PyMySQL state: present -firewall_list: +firewalld_list: - permanent: 'yes' service: mysql state: enabled diff --git a/roles/ensure_mariadb/vars/Fedora-44-default.yml b/roles/ensure_mariadb/vars/Fedora-44-default.yml index 22a9de3..fd6d30b 100644 --- a/roles/ensure_mariadb/vars/Fedora-44-default.yml +++ b/roles/ensure_mariadb/vars/Fedora-44-default.yml @@ -9,7 +9,7 @@ package_list: state: present - name: python3-PyMySQL state: present -firewall_list: +firewalld_list: - permanent: 'yes' service: mysql state: enabled diff --git a/roles/ensure_postfix/meta/main.yml b/roles/ensure_postfix/meta/main.yml index 9fc0b95..fa98cd5 100644 --- a/roles/ensure_postfix/meta/main.yml +++ b/roles/ensure_postfix/meta/main.yml @@ -45,6 +45,7 @@ galaxy_info: # # NOTE: A tag is limited to a single word comprised of alphanumeric characters. # Maximum 20 tags per role. -dependencies: [] +dependencies: + - role: ensure_firewalld # List your role dependencies here, one per line. Be sure to remove the '[]' above, # if you add dependencies to this list. diff --git a/roles/ensure_postfix/tasks/main.yml b/roles/ensure_postfix/tasks/main.yml index e92368f..9c89381 100644 --- a/roles/ensure_postfix/tasks/main.yml +++ b/roles/ensure_postfix/tasks/main.yml @@ -118,13 +118,13 @@ - ansible_facts.packages["firewalld"] is defined - ansible_facts.packages["python3-firewall"] is defined - ensure_postfix is defined - - ensure_postfix.firewall_list is defined - - ensure_postfix.firewall_list is iterable + - ensure_postfix.firewalld_list is defined + - ensure_postfix.firewalld_list is iterable ansible.posix.firewalld: permanent: '{{ item.permanent }}' service: '{{ item.service }}' state: '{{ item.state }}' - loop: '{{ ensure_postfix.firewall_list }}' + loop: '{{ ensure_postfix.firewalld_list }}' loop_control: label: '{{ item.service }} will be {{ item.state }}' notify: diff --git a/roles/ensure_postfix/vars/Fedora-42-default.yml b/roles/ensure_postfix/vars/Fedora-42-default.yml index a53c17c..3d52b0e 100644 --- a/roles/ensure_postfix/vars/Fedora-42-default.yml +++ b/roles/ensure_postfix/vars/Fedora-42-default.yml @@ -28,7 +28,7 @@ package_list: state: present - name: spamassassin state: present -firewall_list: +firewalld_list: - permanent: 'yes' service: smtp state: enabled diff --git a/roles/ensure_postfix/vars/Fedora-43-default.yml b/roles/ensure_postfix/vars/Fedora-43-default.yml index a53c17c..3d52b0e 100644 --- a/roles/ensure_postfix/vars/Fedora-43-default.yml +++ b/roles/ensure_postfix/vars/Fedora-43-default.yml @@ -28,7 +28,7 @@ package_list: state: present - name: spamassassin state: present -firewall_list: +firewalld_list: - permanent: 'yes' service: smtp state: enabled diff --git a/roles/ensure_postfix/vars/Fedora-44-default.yml b/roles/ensure_postfix/vars/Fedora-44-default.yml index a53c17c..3d52b0e 100644 --- a/roles/ensure_postfix/vars/Fedora-44-default.yml +++ b/roles/ensure_postfix/vars/Fedora-44-default.yml @@ -28,7 +28,7 @@ package_list: state: present - name: spamassassin state: present -firewall_list: +firewalld_list: - permanent: 'yes' service: smtp state: enabled