feat(roles/pf): add argument specs

7 files changed, 79 insertions, 34 deletions

diff --git a/group_vars/all.yml b/group_vars/all.yml
index 63697e8..fc3b760 100644
--- a/group_vars/all.yml
+++ b/group_vars/all.yml
@@ -13,7 +13,12 @@ acme_domain_name: "{{ __global_domain_name }}"
 nfsclient_server: stack0
 httpd_use_nfs: true
 relayd_rules: "{{ __services }}"
-pf_rules: "{{ __services }}"
+pf_rules: "[
+    {% for rule in __services if
+        'port' in rule and 'protocol' in rule and 'name' in rule %}
+    {{ {'name': rule.name, 'port': rule.port, 'protocol': rule.protocol} }},
+    {% endfor %}
+  ]"
 acme_rules: "{{ __services }}"
 
 # playbook specific
diff --git a/host_vars/dc0.yml b/host_vars/dc0.yml
index 80c7ef5..fc9b3cc 100644
--- a/host_vars/dc0.yml
+++ b/host_vars/dc0.yml
@@ -13,23 +13,23 @@ __ip:
   internal: 10.10.0.1
 
 __services:
-  ssh:
+  - name: ssh
     protocol: tcp
     port: 22
 
-  wireguard:
+  - name: wireguard
     protocol: udp
     port: 53
 
-  http:
+  - name: http
     protocol: tcp
     port: 80
 
-  https:
+  - name: https
     protocol: tcp
     port: 443
 
-  cgit:
+  - name: cgit
     domain: git
     protocol: tcp
     port: 1235
diff --git a/roles/pf/defaults/main.yml b/roles/pf/defaults/main.yml
index 29a53f8..90b4c7e 100644
--- a/roles/pf/defaults/main.yml
+++ b/roles/pf/defaults/main.yml
@@ -1,13 +1,8 @@
 ---
 
 pf_rules: null
-# name: ...
-#   protocol: ...
-#   port: ...
-# name: ...
-#   protocol: ...
-#   port: ...
 
 pf_configuration_file: /etc/pf.conf
+pf_test_delay: 2
 pf_test_ports:
   - "{{ ansible_port }}"
diff --git a/roles/pf/handlers/main.yml b/roles/pf/handlers/main.yml
deleted file mode 100644
index 2d518eb..0000000
--- a/roles/pf/handlers/main.yml
+++ /dev/null
@@ -1,14 +0,0 @@
----
-
-- name: lint pf configuration
-  ansible.builtin.command: "pfctl -nf {{ pf_configuration_file }}"
-
-- name: enable pf
-  ansible.builtin.command: pfctl -e
-  register: pf_result_enable
-  failed_when:
-    - pf_result_enable.result.rc != 0
-    - "'already enabled' not in pf_result_enabled.result.stderr"
-
-- name: restart pf
-  ansible.builtin.command: pfctl -f "{{ pf_configuration_file }}"
diff --git a/roles/pf/meta/main.yml b/roles/pf/meta/main.yml
new file mode 100644
index 0000000..8a6aa88
--- /dev/null
+++ b/roles/pf/meta/main.yml
@@ -0,0 +1,42 @@
+---
+
+argument_specs:
+  main:
+    short_description: pf main entrypoint.
+    options:
+
+      pf_rules:
+        type: list
+        elements: dict
+        required: true
+        options:
+          name:
+            type: str
+            required: true
+          protocol:
+            type: str
+            required: true
+            choices:
+              - tcp
+              - udp
+            description: Network protocol
+          port:
+            type: int
+            required: true
+            description: Port to be configured
+
+      pf_configuration_file:
+        type: path
+        required: true
+        description: Pf configuration file
+
+      pf_test_delay:
+        type: int
+        required: true
+        description: Pf test delay
+
+      pf_test_ports:
+        type: list
+        element: int
+        required: true
+        description: Ports to be tested
diff --git a/roles/pf/tasks/main.yml b/roles/pf/tasks/main.yml
index 8e81e1c..4fba69e 100644
--- a/roles/pf/tasks/main.yml
+++ b/roles/pf/tasks/main.yml
@@ -7,14 +7,31 @@
     owner: 0
     group: 0
     mode: "0600"
-  notify:
-    - lint pf configuration
-    - enable pf
-    - restart pf
+  register: pf_result_generate_configuration
+
+- name: lint pf configuration  # noqa: no-handler
+  ansible.builtin.command: "pfctl -nf {{ pf_configuration_file }}"
+  register: pf_result_lint_configuration
+  changed_when:
+    - pf_result_generate_configuration.changed
+    - pf_result_lint_configuration.rc != 0
+
+- name: restart pf  # noqa: no-handler
+  ansible.builtin.command: pfctl -f "{{ pf_configuration_file }}"
+  when: pf_result_generate_configuration.changed
 
 - name: test pf rules
   ansible.builtin.wait_for:
     port: "{{ item }}"
-    delay: 2
+    delay: "{{ pf_test_delay }}"
     state: started
   loop: "{{ pf_test_ports }}"
+
+- name: enable pf
+  ansible.builtin.command: pfctl -e
+  register: pf_result_enable
+  changed_when:
+    - "'already enabled' not in pf_result_enable.stderr"
+  failed_when:
+    - pf_result_enable.rc != 0
+    - "'already enabled' not in pf_result_enable.stderr"
diff --git a/roles/pf/templates/pf.conf.j2 b/roles/pf/templates/pf.conf.j2
index e60b4a6..193c9d2 100644
--- a/roles/pf/templates/pf.conf.j2
+++ b/roles/pf/templates/pf.conf.j2
@@ -11,9 +11,9 @@ block all
 pass in quick on egress proto tcp to port {{ ansible_port }}
 
 # host services
-{% for name, rules in pf_rules.items() %}
-# {{ name }}
-pass in quick on egress proto {{ rules.protocol }} to port {{ rules.port }}
+{% for rule in pf_rules %}
+# {{ rule.name }}
+pass in quick on egress proto {{ rule.protocol }} to port {{ rule.port }}
 {% endfor %}
 
 # wireguard