feat: Merge rules and tables in one file

This commit is contained in:
pulsar89.5 2023-12-28 17:39:20 +01:00
parent 35d31eb752
commit 650c72469d
4 changed files with 10 additions and 9 deletions

View File

@ -33,10 +33,7 @@
group: root group: root
mode: u=rw,g=,o= mode: u=rw,g=,o=
src: "{{ role_path }}/templates/rules.conf.j2" src: "{{ role_path }}/templates/rules.conf.j2"
dest: "/srv/nftables/rules_{{ item.filename }}.conf" dest: "/srv/nftables/rules.conf"
loop: "{{ nftables_rules }}"
loop_control:
label: "{{ item.filename }}"
become: true become: true
notify: Redémarrer nftables.service notify: Redémarrer nftables.service

View File

@ -12,6 +12,9 @@
owner: root owner: root
group: root group: root
mode: u=rwx,g=rx,o=rx mode: u=rwx,g=rx,o=rx
state: directory state: "{{ item }}"
path: /srv/nftables path: /srv/nftables
become: true become: true
loop:
- absent
- directory

View File

@ -16,8 +16,8 @@ table inet filter {
# accept neighbour discovery otherwise IPv6 connectivity breaks. # accept neighbour discovery otherwise IPv6 connectivity breaks.
ip6 nexthdr icmpv6 icmpv6 type {nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert} accept ip6 nexthdr icmpv6 icmpv6 type {nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert} accept
# include specifics rules # include specific rules
include "/srv/nftables/rules_*.conf" include "/srv/nftables/rules.conf"
# count and drop any other traffic # count and drop any other traffic
counter drop counter drop

View File

@ -1,5 +1,6 @@
# {{ ansible_managed }} # {{ ansible_managed }}
{% for item in nftables_rules %}
{% for rule in item.rules %} # {{ item.comment }}
{{ rule }} {{ item.rules | join('\n') }}
{% endfor %} {% endfor %}