Merge pull request #88 from corvus-migratorius/role-win_firewall

Role win firewall

README.md

@@ -40,4 +40,5 @@
 - [wg_hub](roles/wg_hub/README.md)
 - [wg_spoke](roles/wg_spoke/README.md)
 - [win_chocolatey_install](roles/win_chocolatey_install/README.md)
+- [win_firewall](roles/win_firewall/README.md)
 - [xfs_project_quotas](roles/xfs_project_quotas/README.md)

galaxy.yml

@@ -1,7 +1,7 @@
 ---
 namespace: genlab
 name: common
-version: 0.36.0
+version: 0.37.0
 readme: README.md
 authors:
   - Alexander Gorelyshev (corvus-migratorius@proton.me)

requirements.yml

@@ -9,3 +9,4 @@ collections:
   - name: lucasheld.uptime_kuma
   - name: maxhoesel.borgbackup
   - name: ansible.windows
+  - name: community.windows

roles/win_firewall/README.md

@@ -0,0 +1,58 @@
+win_firewall
+=========
+
+Configure windows hosts as a Spoke in the Wireguard Spoke-and-Hub topology.
+
+Requirements
+------------
+
+None
+
+Role Variables
+--------------
+
+```yaml
+win_firewall_name: name     # Required
+
+# Default variables
+win_firewall_action: allow
+win_firewall_direction: in
+win_firewall_enabled: true
+win_firewall_localip: any
+win_firewall_localport: any
+win_firewall_profiles: domain,private,public
+win_firewall_program: any
+win_firewall_protocol: any
+win_firewall_remoteip: any
+win_firewall_remoteport: any
+win_firewall_service: any
+win_firewall_state: present
+```
+
+Dependencies
+------------
+
+ansible.windows
+community.windows
+
+Example Playbook
+----------------
+
+```yaml
+roles:
+  - role: genlab.common.win_firewall
+    win_firewall_name: Allow port 1234 to 10.0.0.0/24
+    win_firewall_action: allow
+    win_firewall_localport: 1234
+    win_firewall_remoteip: 10.0.0.0/24
+```
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+malyuk.ss@genlab.llc

roles/win_firewall/defaults/main.yml

@@ -0,0 +1,13 @@
+---
+win_firewall_action: allow
+win_firewall_direction: in
+win_firewall_enabled: true
+win_firewall_localip: any
+win_firewall_localport: any
+win_firewall_profiles: domain,private,public
+win_firewall_program: any
+win_firewall_protocol: any
+win_firewall_remoteip: any
+win_firewall_remoteport: any
+win_firewall_service: any
+win_firewall_state: present

roles/win_firewall/handlers/main.yml

@@ -0,0 +1 @@
+---

roles/win_firewall/meta/main.yml

@@ -0,0 +1,16 @@
+---
+galaxy_info:
+  role_name: "win_firewall"
+  namespace: genlab
+  author: "Sergey Malyuk"
+  company: "Genlab, LLC"
+  description: "Configures clean windows firewall"
+  license: "MIT"
+  min_ansible_version: "2.16"
+
+  platforms:
+    - name: "Windows"
+
+  galaxy_tags: []
+
+dependencies: []

roles/win_firewall/molecule/default/converge.yml

@@ -0,0 +1,9 @@
+---
+- name: Converge
+  hosts: all
+  pre_tasks:
+    # Blank task for ignoring CI testing
+    # This role was tested manually
+    - name: Blank
+      ansible.builtin.command: echo
+      changed_when: false

roles/win_firewall/molecule/default/molecule.yml

@@ -0,0 +1,22 @@
+---
+dependency:
+  name: galaxy
+driver:
+  name: docker
+platforms:
+  - name: ubuntu
+    image: geerlingguy/docker-ubuntu2204-ansible:latest
+    pre_build_image: true
+    command: ${MOLECULE_DOCKER_COMMAND:-""}
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    cgroupns_mode: host
+    privileged: true
+provisioner:
+  name: ansible
+verifier:
+  name: ansible
+lint: |
+  set -e
+  yamllint .
+  ansible-lint .

roles/win_firewall/molecule/default/verify.yml

@@ -0,0 +1,11 @@
+---
+
+- name: Verify
+  hosts: all
+  gather_facts: false
+  tasks:
+    # Blank task for ignoring CI testing
+    # This role was tested manually
+    - name: Blank
+      ansible.builtin.command: echo
+      changed_when: false

roles/win_firewall/tasks/main.yml

@@ -0,0 +1,50 @@
+---
+- name: Print out rule name for convenient debugging
+  ansible.builtin.debug:
+    msg: "{{ win_firewall_name }}"
+
+- name: Check if firewall is configured
+  block:
+    - name: Get firewall flag stat
+      ansible.windows.win_stat:
+        path: C:\firewall.flag
+      register: win_firewall_firewall_flag
+
+    - name: Assert that firewall.flag exists
+      ansible.builtin.assert:
+        that: win_firewall_firewall_flag.stat.exists
+        success_msg: "firewall.flag exists"
+        fail_msg: "firewall.flag DOES NOT exist"
+
+  rescue:
+    - name: Disable Windows Firewall
+      ansible.windows.win_firewall:
+        state: disabled
+
+    - name: Delete all firewall rules
+      ansible.windows.win_shell: netsh advfirewall firewall delete rule name=all
+
+    - name: Create firewall.flag
+      ansible.windows.win_file:
+        path: C:\firewall.flag
+        state: touch
+
+- name: Create firewall rule
+  community.windows.win_firewall_rule:
+    name: "{{ win_firewall_name }}"
+    action: "{{ win_firewall_action }}"
+    direction: "{{ win_firewall_direction }}"
+    enabled: "{{ win_firewall_enabled }}"
+    localip: "{{ win_firewall_localip }}"
+    localport: "{{ win_firewall_localport }}"
+    profiles: "{{ win_firewall_profiles }}"
+    program: "{{ win_firewall_program }}"
+    protocol: "{{ win_firewall_protocol }}"
+    remoteip: "{{ win_firewall_remoteip }}"
+    remoteport: "{{ win_firewall_remoteport }}"
+    service: "{{ win_firewall_service }}"
+    state: "{{ win_firewall_state }}"
+
+- name: Enable Windows Firewall
+  ansible.windows.win_firewall:
+    state: enabled

roles/win_firewall/vars/main.yml

@@ -0,0 +1 @@
+---