Add firewalld configuration role, and have services that need it depend on it.

roles/ensure_cockpit/tasks/main.yml

@@ -83,5 +83,20 @@
   loop_control:
     label: '{{ item.name }} will be {{ item.state }}'
   notify: [ensure_cockpit.package_facts, ensure_cockpit.service_facts]
+- name: ensure firewall
+  when:
+    - ansible_facts["system"] == 'Linux'
+    - ansible_facts.packages["firewalld"] is defined
+    - ansible_facts.packages["python3-firewall"] is defined
+    - ensure_cockpit is defined
+    - ensure_cockpit.firewalld_list is defined
+    - ensure_cockpit.firewalld_list is iterable
+  ansible.posix.firewalld:
+    permanent: '{{ item.permanent }}'
+    service: '{{ item.service }}'
+    state: '{{ item.state }}'
+  loop: '{{ ensure_cockpit.firewalld_list }}'
+  loop_control:
+    label: '{{ item.service }} will be {{ item.state }}'
 - name: flush handlers
   ansible.builtin.meta: flush_handlers