From a9c0ccdf99571e51cfe916a5e875e834a94193fe Mon Sep 17 00:00:00 2001 From: Tobias Date: Sun, 14 Jun 2026 21:09:08 +0000 Subject: [PATCH] Add playbooks/firewall.yml --- playbooks/firewall.yml | 65 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 65 insertions(+) create mode 100644 playbooks/firewall.yml diff --git a/playbooks/firewall.yml b/playbooks/firewall.yml new file mode 100644 index 0000000..80f30ad --- /dev/null +++ b/playbooks/firewall.yml @@ -0,0 +1,65 @@ +- name: configure firewall rules + hosts: alma + become: true + + tasks: + - name: confirm firewall is active + service: + name: firewalld + state: started + enabled: true + + - name: allow ssh traffic in internal zone + ansible.posix.firewalld: + zone: internal + service: ssh + permanent: true + state: enabled + + - name: allow calibre traffic in internal zone + ansible.posix.firewalld: + zone: internal + port: 8083/tcp + permanent: true + state: enabled + + - name: allow jellyfin traffic in internal zone + ansible.posix.firewalld: + zone: internal + port: 8096/tcp + permanent: true + state: enabled + + - name: allow http traffic in internal zone + ansible.posix.firewalld: + zone: internal + service: http + permanent: true + state: enabled + + - name: allow https traffic in internal zone + ansible.posix.firewalld: + zone: internal + service: https + permanent: true + state: enabled + + - name: allow http traffic in public zone + ansible.posix.firewalld: + zone: public + service: http + permanent: true + state: enabled + + - name: allow https traffic in public zone + ansible.posix.firewalld: + zone: public + service: https + permanent: true + state: enabled + + - name: add source to internal zone + ansible.builtin.command: firewall-cmd --zone=internal --add-source=192.168.0.0/24 --permanent + + - name: reload firewalld + ansible.builtin.command: firewall-cmd --reload