---
- name: "Ensure that ufw is installed"
  ansible.builtin.apt:
    name: ufw
    update_cache: true

- name: "Disable IPv6"
  when: (disable_ipv6 is defined) and (disable_ipv6 is true)
  ansible.builtin.lineinfile:
    path: /etc/default/ufw
    regexp: ^IPV6
    line: IPV6=no

- name: "Deny incoming connections"
  notify: Reload-ufw
  community.general.ufw:
    direction: incoming
    proto: any
    policy: deny

- name: "Allow outgoing connections"
  notify: Reload-ufw
  community.general.ufw:
    direction: outgoing
    proto: any
    policy: allow

- name: "Allow SSH access"
  notify: Reload-ufw
  community.general.ufw:
    rule: "{{ ufw_limit_ssh | ternary('limit', 'allow') }}"
    port: "{{ ufw_openssh_port }}"
    proto: tcp

- name: "Set whitelist rules"
  notify: Reload-ufw
  loop: "{{ ufw_rules }}"
  community.general.ufw:
    rule: "{{ item.rule | default('allow') }}"
    comment: "{{ item.comment | default(omit) }}"
    port: "{{ item.port | default(omit) }}"
    proto: "{{ item.proto | default('any') }}"
    src: "{{ item.src | default('any') }}"
    dest: "{{ item.dest | default(omit) }}"
    interface: "{{ item.interface | default(omit) }}"
    direction: "{{ item.direction | default(omit) }}"
    route: "{{ item.route | default(false) }}"

- name: "Enable the ufw service"
  community.general.ufw:
    state: enabled

- name: "Flush handlers"
  ansible.builtin.meta: flush_handlers