55 lines
1.4 KiB
YAML
55 lines
1.4 KiB
YAML
---
|
|
- name: "Ensure that ufw is installed"
|
|
ansible.builtin.apt:
|
|
name: ufw
|
|
update_cache: true
|
|
|
|
- name: "Disable IPv6"
|
|
when: (disable_ipv6 is defined) and (disable_ipv6 is true)
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/default/ufw
|
|
regexp: ^IPV6
|
|
line: IPV6=no
|
|
|
|
- name: "Deny incoming connections"
|
|
notify: Reload-ufw
|
|
community.general.ufw:
|
|
direction: incoming
|
|
proto: any
|
|
policy: deny
|
|
|
|
- name: "Allow outgoing connections"
|
|
notify: Reload-ufw
|
|
community.general.ufw:
|
|
direction: outgoing
|
|
proto: any
|
|
policy: allow
|
|
|
|
- name: "Allow SSH access"
|
|
notify: Reload-ufw
|
|
community.general.ufw:
|
|
rule: "{{ limit_ssh | ternary('limit', 'allow') }}"
|
|
port: "{{ openssh_port }}"
|
|
proto: tcp
|
|
|
|
- name: "Set whitelist rules"
|
|
notify: Reload-ufw
|
|
loop: "{{ rules }}"
|
|
community.general.ufw:
|
|
rule: "{{ item.rule | default('allow') }}"
|
|
comment: "{{ item.comment | default(omit) }}"
|
|
port: "{{ item.port | default(omit) }}"
|
|
proto: "{{ item.proto | default('any') }}"
|
|
src: "{{ item.src | default('any') }}"
|
|
dest: "{{ item.dest | default(omit) }}"
|
|
interface: "{{ item.interface | default(omit) }}"
|
|
direction: "{{ item.direction | default(omit) }}"
|
|
route: "{{ item.route | default(false) }}"
|
|
|
|
- name: "Enable the ufw service"
|
|
community.general.ufw:
|
|
state: enabled
|
|
|
|
- name: "Flush handlers"
|
|
ansible.builtin.meta: flush_handlers
|