aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--group_vars/all.yml7
-rw-r--r--host_vars/dc0.yml10
-rw-r--r--roles/pf/defaults/main.yml7
-rw-r--r--roles/pf/handlers/main.yml14
-rw-r--r--roles/pf/meta/main.yml42
-rw-r--r--roles/pf/tasks/main.yml27
-rw-r--r--roles/pf/templates/pf.conf.j26
7 files changed, 79 insertions, 34 deletions
diff --git a/group_vars/all.yml b/group_vars/all.yml
index 63697e8..fc3b760 100644
--- a/group_vars/all.yml
+++ b/group_vars/all.yml
@@ -13,7 +13,12 @@ acme_domain_name: "{{ __global_domain_name }}"
nfsclient_server: stack0
httpd_use_nfs: true
relayd_rules: "{{ __services }}"
-pf_rules: "{{ __services }}"
+pf_rules: "[
+ {% for rule in __services if
+ 'port' in rule and 'protocol' in rule and 'name' in rule %}
+ {{ {'name': rule.name, 'port': rule.port, 'protocol': rule.protocol} }},
+ {% endfor %}
+ ]"
acme_rules: "{{ __services }}"
# playbook specific
diff --git a/host_vars/dc0.yml b/host_vars/dc0.yml
index 80c7ef5..fc9b3cc 100644
--- a/host_vars/dc0.yml
+++ b/host_vars/dc0.yml
@@ -13,23 +13,23 @@ __ip:
internal: 10.10.0.1
__services:
- ssh:
+ - name: ssh
protocol: tcp
port: 22
- wireguard:
+ - name: wireguard
protocol: udp
port: 53
- http:
+ - name: http
protocol: tcp
port: 80
- https:
+ - name: https
protocol: tcp
port: 443
- cgit:
+ - name: cgit
domain: git
protocol: tcp
port: 1235
diff --git a/roles/pf/defaults/main.yml b/roles/pf/defaults/main.yml
index 29a53f8..90b4c7e 100644
--- a/roles/pf/defaults/main.yml
+++ b/roles/pf/defaults/main.yml
@@ -1,13 +1,8 @@
---
pf_rules: null
-# name: ...
-# protocol: ...
-# port: ...
-# name: ...
-# protocol: ...
-# port: ...
pf_configuration_file: /etc/pf.conf
+pf_test_delay: 2
pf_test_ports:
- "{{ ansible_port }}"
diff --git a/roles/pf/handlers/main.yml b/roles/pf/handlers/main.yml
deleted file mode 100644
index 2d518eb..0000000
--- a/roles/pf/handlers/main.yml
+++ /dev/null
@@ -1,14 +0,0 @@
----
-
-- name: lint pf configuration
- ansible.builtin.command: "pfctl -nf {{ pf_configuration_file }}"
-
-- name: enable pf
- ansible.builtin.command: pfctl -e
- register: pf_result_enable
- failed_when:
- - pf_result_enable.result.rc != 0
- - "'already enabled' not in pf_result_enabled.result.stderr"
-
-- name: restart pf
- ansible.builtin.command: pfctl -f "{{ pf_configuration_file }}"
diff --git a/roles/pf/meta/main.yml b/roles/pf/meta/main.yml
new file mode 100644
index 0000000..8a6aa88
--- /dev/null
+++ b/roles/pf/meta/main.yml
@@ -0,0 +1,42 @@
+---
+
+argument_specs:
+ main:
+ short_description: pf main entrypoint.
+ options:
+
+ pf_rules:
+ type: list
+ elements: dict
+ required: true
+ options:
+ name:
+ type: str
+ required: true
+ protocol:
+ type: str
+ required: true
+ choices:
+ - tcp
+ - udp
+ description: Network protocol
+ port:
+ type: int
+ required: true
+ description: Port to be configured
+
+ pf_configuration_file:
+ type: path
+ required: true
+ description: Pf configuration file
+
+ pf_test_delay:
+ type: int
+ required: true
+ description: Pf test delay
+
+ pf_test_ports:
+ type: list
+ element: int
+ required: true
+ description: Ports to be tested
diff --git a/roles/pf/tasks/main.yml b/roles/pf/tasks/main.yml
index 8e81e1c..4fba69e 100644
--- a/roles/pf/tasks/main.yml
+++ b/roles/pf/tasks/main.yml
@@ -7,14 +7,31 @@
owner: 0
group: 0
mode: "0600"
- notify:
- - lint pf configuration
- - enable pf
- - restart pf
+ register: pf_result_generate_configuration
+
+- name: lint pf configuration # noqa: no-handler
+ ansible.builtin.command: "pfctl -nf {{ pf_configuration_file }}"
+ register: pf_result_lint_configuration
+ changed_when:
+ - pf_result_generate_configuration.changed
+ - pf_result_lint_configuration.rc != 0
+
+- name: restart pf # noqa: no-handler
+ ansible.builtin.command: pfctl -f "{{ pf_configuration_file }}"
+ when: pf_result_generate_configuration.changed
- name: test pf rules
ansible.builtin.wait_for:
port: "{{ item }}"
- delay: 2
+ delay: "{{ pf_test_delay }}"
state: started
loop: "{{ pf_test_ports }}"
+
+- name: enable pf
+ ansible.builtin.command: pfctl -e
+ register: pf_result_enable
+ changed_when:
+ - "'already enabled' not in pf_result_enable.stderr"
+ failed_when:
+ - pf_result_enable.rc != 0
+ - "'already enabled' not in pf_result_enable.stderr"
diff --git a/roles/pf/templates/pf.conf.j2 b/roles/pf/templates/pf.conf.j2
index e60b4a6..193c9d2 100644
--- a/roles/pf/templates/pf.conf.j2
+++ b/roles/pf/templates/pf.conf.j2
@@ -11,9 +11,9 @@ block all
pass in quick on egress proto tcp to port {{ ansible_port }}
# host services
-{% for name, rules in pf_rules.items() %}
-# {{ name }}
-pass in quick on egress proto {{ rules.protocol }} to port {{ rules.port }}
+{% for rule in pf_rules %}
+# {{ rule.name }}
+pass in quick on egress proto {{ rule.protocol }} to port {{ rule.port }}
{% endfor %}
# wireguard
remember that computers suck.