tasks/configuration.yml

@@ -33,8 +33,10 @@
     group: root
     mode: u=rw,g=,o=
     src: "{{ role_path }}/templates/rules.conf.j2"
-    dest: "/srv/nftables/rules.conf"
+    dest: "/srv/nftables/rules_{{ item.filename }}.conf"
-  when: nftables_rules | length > 0 
+  loop: "{{ nftables_rules }}"
+  loop_control:
+    label: "{{ item.filename }}"
   become: true
   notify: Redémarrer nftables.service
 
@@ -43,8 +45,10 @@
     owner: root
     group: root
     mode: u=rw,g=,o=
-    src: tables.conf.j2
+    src: "{{ role_path }}/templates/tables.conf.j2"
-    dest: /srv/nftables/tables.conf
+    dest: "/srv/nftables/tables_{{ item.filename }}.conf"
-  when: nftables_tables | length > 0
+  loop: "{{ nftables_tables }}"
+  loop_control:
+    label: "{{ item.filename }}"
   become: true
   notify: Redémarrer nftables.service

tasks/installation.yml

@@ -12,9 +12,6 @@
     owner: root
     group: root
     mode: u=rwx,g=rx,o=rx
-    state: "{{ item }}"
+    state: directory
     path: /srv/nftables
   become: true
-  loop:
-    - absent
-    - directory

templates/nftables.conf.j2

@@ -16,8 +16,8 @@ table inet filter {
     # accept neighbour discovery otherwise IPv6 connectivity breaks.
     ip6 nexthdr icmpv6 icmpv6 type {nd-neighbor-solicit,  nd-router-advert, nd-neighbor-advert} accept
 
-    # include specific rules
+    # include specifics rules
-    include "/srv/nftables/rules.conf"
+    include "/srv/nftables/rules_*.conf"
 
     # count and drop any other traffic
     counter drop

templates/rules.conf.j2

@@ -1,6 +1,5 @@
 # {{ ansible_managed }}
-{% for item in nftables_rules %}
 
-# {{ item.comment }}
+{% for rule in item.rules %}
-{{ item.rules | join('\n') }}
+{{ rule }}
 {% endfor %}

templates/table.conf.j2

@@ -1,55 +0,0 @@
-{% if 
-    item.ipv4_rules.prerouting | length > 0
-    or
-    item.ipv4_rules.postrouting | length > 0
-%}
-table ip {{ item.name }} {
-{% if item.ipv4_rules.prerouting | length > 0 %}
-  chain prerouting {
-    type nat hook prerouting priority 0;
-
-{% for rule in item.ipv4_rules.prerouting %}
-    {{ rule }}
-{% endfor %}
-  }
-{% endif %}
-
-{% if item.ipv4_rules.postrouting | length > 0 %}
-  chain postrouting {
-    type nat hook postrouting priority 100; policy accept;
-
-{% for rule in item.ipv4_rules.postrouting %}
-    {{ rule }}
-{% endfor %}
-  }
-{% endif %}
-}
-{% endif %}
-
-{% if 
-    item.ipv6_rules.prerouting | length > 0
-    or
-    item.ipv6_rules.postrouting | length > 0
-%}
-table ip6 {{ item.name }} {
-{% if item.ipv6_rules.prerouting | length > 0 %}
-  chain prerouting {
-    type nat hook prerouting priority 0;
-
-{% for rule in item.ipv6_rules.prerouting %}
-    {{ rule }}
-{% endfor %}
-  }
-{% endif %}
-
-{% if item.ipv6_rules.postrouting | length > 0 %}
-  chain postrouting {
-    type nat hook postrouting priority 100; policy accept;
-
-{% for rule in item.ipv6_rules.postrouting %}
-    {{ rule }}
-{% endfor %}
-  }
-{% endif %}
-}
-{% endif %}

templates/tables.conf.j2

@@ -1,5 +1,57 @@
 # {{ ansible_managed }}
-{% for item in nftables_tables %}
 
-{% include "table.conf.j2" %}
+{% if 
+    item.ipv4_rules.prerouting | length > 0
+    or
+    item.ipv4_rules.postrouting | length > 0
+%}
+table ip {{ item.filename }} {
+{% if item.ipv4_rules.prerouting | length > 0 %}
+  chain prerouting {
+    type nat hook prerouting priority 0;
+
+{% for rule in item.ipv4_rules.prerouting %}
+    {{ rule }}
 {% endfor %}
+  }
+{% endif %}
+
+{% if item.ipv4_rules.postrouting | length > 0 %}
+  chain postrouting {
+    type nat hook postrouting priority 100; policy accept;
+
+{% for rule in item.ipv4_rules.postrouting %}
+    {{ rule }}
+{% endfor %}
+  }
+{% endif %}
+}
+{% endif %}
+
+{% if 
+    item.ipv6_rules.prerouting | length > 0
+    or
+    item.ipv6_rules.postrouting | length > 0
+%}
+table ip6 {{ item.filename }} {
+{% if item.ipv6_rules.prerouting | length > 0 %}
+  chain prerouting {
+    type nat hook prerouting priority 0;
+
+{% for rule in item.ipv6_rules.prerouting %}
+    {{ rule }}
+{% endfor %}
+  }
+{% endif %}
+
+{% if item.ipv6_rules.postrouting | length > 0 %}
+  chain postrouting {
+    type nat hook postrouting priority 100; policy accept;
+
+{% for rule in item.ipv6_rules.postrouting %}
+    {{ rule }}
+{% endfor %}
+  }
+{% endif %}
+}
+{% endif %}