add ufw role

roles/ufw/tasks/main.yml

@@ -0,0 +1,54 @@
+---
+- name: "Ensure that ufw is installed"
+  ansible.builtin.apt:
+    name: ufw
+    update_cache: true
+
+- name: "Disable IPv6"
+  when: (disable_ipv6 is defined) and (disable_ipv6 is true)
+  ansible.builtin.lineinfile:
+    path: /etc/default/ufw
+    regexp: ^IPV6
+    line: IPV6=no
+
+- name: "Deny incoming connections"
+  notify: Reload-ufw
+  community.general.ufw:
+    direction: incoming
+    proto: any
+    policy: deny
+
+- name: "Allow outgoing connections"
+  notify: Reload-ufw
+  community.general.ufw:
+    direction: outgoing
+    proto: any
+    policy: allow
+
+- name: "Allow SSH access"
+  notify: Reload-ufw
+  community.general.ufw:
+    rule: "{{ limit_ssh | ternary('limit', 'allow') }}"
+    port: "{{ openssh_port }}"
+    proto: tcp
+
+- name: "Set whitelist rules"
+  notify: Reload-ufw
+  loop: "{{ rules }}"
+  community.general.ufw:
+    rule: "{{ item.rule | default('allow') }}"
+    comment: "{{ item.comment | default(omit) }}"
+    port: "{{ item.port | default(omit) }}"
+    proto: "{{ item.proto | default('any') }}"
+    src: "{{ item.src | default('any') }}"
+    dest: "{{ item.dest | default(omit) }}"
+    interface: "{{ item.interface | default(omit) }}"
+    direction: "{{ item.direction | default(omit) }}"
+    route: "{{ item.route | default(false) }}"
+
+- name: "Enable the ufw service"
+  community.general.ufw:
+    state: enabled
+
+- name: "Flush handlers"
+  ansible.builtin.meta: flush_handlers