ansible/role_nftables
1
0
Fork 0
Code Pull Requests Releases Activity

feat: Merge rules and tables in one file

Browse Source
This commit is contained in:
pulsar89.5 2023-12-28 17:39:20 +01:00
parent 35d31eb752
commit da9a7db186
3 changed files with 7 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
tasks/configuration.yml
View File

@ -33,10 +33,7 @@
group: root group: root
mode: u=rw,g=,o= mode: u=rw,g=,o=
src: "{{ role_path }}/templates/rules.conf.j2" src: "{{ role_path }}/templates/rules.conf.j2"
dest: "/srv/nftables/rules_{{ item.filename }}.conf" dest: "/srv/nftables/rules.conf"
loop: "{{ nftables_rules }}"
loop_control:
label: "{{ item.filename }}"
become: true become: true
notify: Redémarrer nftables.service notify: Redémarrer nftables.service

4
templates/nftables.conf.j2
View File

@ -16,8 +16,8 @@ table inet filter {
# accept neighbour discovery otherwise IPv6 connectivity breaks. # accept neighbour discovery otherwise IPv6 connectivity breaks.
ip6 nexthdr icmpv6 icmpv6 type {nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert} accept ip6 nexthdr icmpv6 icmpv6 type {nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert} accept
# include specifics rules # include specific rules
include "/srv/nftables/rules_*.conf" include "/srv/nftables/rules.conf"
# count and drop any other traffic # count and drop any other traffic
counter drop counter drop

6
templates/rules.conf.j2
View File

@ -1,5 +1,7 @@
# {{ ansible_managed }} # {{ ansible_managed }}
{% for rule in item.rules %} {% for item in nftables_rules %}
{{ rule }} # {{ item.comment }}
{{ item.rules | join('\n') }}
{% endfor %} {% endfor %}