Add firewalld configuration role, and have services that need it depend on it.

2026-08-09 11:29:08 -05:00
parent 6c7ecfc724
commit 331f8beb3b
68 changed files with 547 additions and 33 deletions
@@ -45,6 +45,7 @@ galaxy_info:
    #
    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
    #       Maximum 20 tags per role.
-dependencies: []
+dependencies:
+  - role: ensure_firewalld
  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
  # if you add dependencies to this list.
@@ -83,5 +83,20 @@
  loop_control:
    label: '{{ item.name }} will be {{ item.state }}'
  notify: [ensure_cockpit.package_facts, ensure_cockpit.service_facts]
+- name: ensure firewall
+  when:
+    - ansible_facts["system"] == 'Linux'
+    - ansible_facts.packages["firewalld"] is defined
+    - ansible_facts.packages["python3-firewall"] is defined
+    - ensure_cockpit is defined
+    - ensure_cockpit.firewalld_list is defined
+    - ensure_cockpit.firewalld_list is iterable
+  ansible.posix.firewalld:
+    permanent: '{{ item.permanent }}'
+    service: '{{ item.service }}'
+    state: '{{ item.state }}'
+  loop: '{{ ensure_cockpit.firewalld_list }}'
+  loop_control:
+    label: '{{ item.service }} will be {{ item.state }}'
 - name: flush handlers
  ansible.builtin.meta: flush_handlers
@@ -21,3 +21,8 @@ service_list:
  - name: cockpit.socket
    state: started
    enabled: 'yes'
+
+firewalld_list:
+  - permanent: "yes"
+    service: cockpit
+    state: enabled
@@ -21,3 +21,8 @@ service_list:
  - name: cockpit.socket
    state: started
    enabled: 'yes'
+
+firewalld_list:
+  - permanent: "yes"
+    service: cockpit
+    state: enabled
@@ -21,3 +21,8 @@ service_list:
  - name: cockpit.socket
    state: started
    enabled: 'yes'
+
+firewalld_list:
+  - permanent: "yes"
+    service: cockpit
+    state: enabled
@@ -21,3 +21,8 @@ service_list:
  - name: cockpit.socket
    state: started
    enabled: 'yes'
+
+firewalld_list:
+  - permanent: "yes"
+    service: cockpit
+    state: enabled
@@ -21,3 +21,8 @@ service_list:
  - name: cockpit.socket
    state: started
    enabled: 'yes'
+
+firewalld_list:
+  - permanent: "yes"
+    service: cockpit
+    state: enabled
@@ -23,3 +23,8 @@ service_list:
  - name: cockpit.socket
    state: started
    enabled: 'yes'
+
+firewalld_list:
+  - permanent: "yes"
+    service: cockpit
+    state: enabled
@@ -23,3 +23,8 @@ service_list:
  - name: cockpit.socket
    state: started
    enabled: 'yes'
+
+firewalld_list:
+  - permanent: "yes"
+    service: cockpit
+    state: enabled
@@ -27,3 +27,8 @@ service_list:
  - name: cockpit.socket
    state: started
    enabled: 'yes'
+
+firewalld_list:
+  - permanent: "yes"
+    service: cockpit
+    state: enabled
@@ -27,3 +27,8 @@ service_list:
  - name: cockpit.socket
    state: started
    enabled: 'yes'
+
+firewalld_list:
+  - permanent: "yes"
+    service: cockpit
+    state: enabled
@@ -27,3 +27,8 @@ service_list:
  - name: cockpit.socket
    state: started
    enabled: 'yes'
+
+firewalld_list:
+  - permanent: "yes"
+    service: cockpit
+    state: enabled
@@ -21,3 +21,8 @@ service_list:
  - name: cockpit.socket
    state: started
    enabled: 'yes'
+
+firewalld_list:
+  - permanent: "yes"
+    service: cockpit
+    state: enabled
@@ -21,3 +21,8 @@ service_list:
  - name: cockpit.socket
    state: started
    enabled: 'yes'
+
+firewalld_list:
+  - permanent: "yes"
+    service: cockpit
+    state: enabled
@@ -21,3 +21,8 @@ service_list:
  - name: cockpit.socket
    state: started
    enabled: 'yes'
+
+firewalld_list:
+  - permanent: "yes"
+    service: cockpit
+    state: enabled
@@ -21,3 +21,8 @@ service_list:
  - name: cockpit.socket
    state: started
    enabled: 'yes'
+
+firewalld_list:
+  - permanent: "yes"
+    service: cockpit
+    state: enabled
@@ -23,3 +23,8 @@ service_list:
  - name: cockpit.socket
    state: started
    enabled: 'yes'
+
+firewalld_list:
+  - permanent: "yes"
+    service: cockpit
+    state: enabled
@@ -23,3 +23,8 @@ service_list:
  - name: cockpit.socket
    state: started
    enabled: 'yes'
+
+firewalld_list:
+  - permanent: "yes"
+    service: cockpit
+    state: enabled
@@ -23,3 +23,8 @@ service_list:
  - name: cockpit.socket
    state: started
    enabled: 'yes'
+
+firewalld_list:
+  - permanent: "yes"
+    service: cockpit
+    state: enabled