42 lines
892 B
YAML
42 lines
892 B
YAML
|
---
|
||
|
|
- name: ensure /etc/nftables.d exists
|
||
|
|
ansible.builtin.file:
|
||
|
|
path: /etc/nftables.d
|
||
|
|
state: directory
|
||
|
|
mode: "0755"
|
||
|
|
|
||
|
|
- name: deploy nftables rule
|
||
|
|
ansible.builtin.copy:
|
||
|
|
src: "{{ item }}"
|
||
|
|
dest: "/etc/nftables.d/{{ item }}"
|
||
|
|
mode: "0644"
|
||
|
|
loop:
|
||
|
|
- 10-filter.nft
|
||
|
|
- 10-nat.nft
|
||
|
|
- 20-vpn.nft
|
||
|
|
- 30-proxy.nft
|
||
|
|
- 40-sets.nft
|
||
|
|
notify: restart nftables
|
||
|
|
|
||
|
|
- name: render forward
|
||
|
|
ansible.builtin.template:
|
||
|
|
src: 90-forward.nft.j2
|
||
|
|
dest: /etc/nftables.d/90-forward.nft
|
||
|
|
mode: "0644"
|
||
|
|
notify: restart nftables
|
||
|
|
|
||
|
|
- name: render dstnat
|
||
|
|
ansible.builtin.template:
|
||
|
|
src: 90-dstnat.nft.j2
|
||
|
|
dest: /etc/nftables.d/90-dstnat.nft
|
||
|
|
mode: "0644"
|
||
|
|
notify: restart nftables
|
||
|
|
|
||
|
|
- name: deploy nftables.conf
|
||
|
|
ansible.builtin.copy:
|
||
|
|
src: nftables.conf
|
||
|
|
dest: /etc/nftables.conf
|
||
|
|
mode: "0644"
|
||
|
|
validate: "nft -c -f %s"
|
||
|
|
notify: restart nftables
|