Add playbooks/firewall.yml

playbooks/firewall.yml

@@ -0,0 +1,65 @@
+- name: configure firewall rules
+  hosts: alma
+  become: true
+
+  tasks:
+  - name: confirm firewall is active
+    service:
+      name: firewalld
+      state: started
+      enabled: true
+
+  - name: allow ssh traffic in internal zone
+    ansible.posix.firewalld:
+      zone: internal
+      service: ssh
+      permanent: true
+      state: enabled
+
+  - name: allow calibre traffic in internal zone
+    ansible.posix.firewalld:
+      zone: internal
+      port: 8083/tcp
+      permanent: true
+      state: enabled
+
+  - name: allow jellyfin traffic in internal zone
+    ansible.posix.firewalld:
+      zone: internal
+      port: 8096/tcp
+      permanent: true
+      state: enabled
+
+  - name: allow http traffic in internal zone
+    ansible.posix.firewalld:
+      zone: internal
+      service: http
+      permanent: true
+      state: enabled
+
+  - name: allow https traffic in internal zone
+    ansible.posix.firewalld:
+      zone: internal
+      service: https
+      permanent: true
+      state: enabled
+
+  - name: allow http traffic in public zone
+    ansible.posix.firewalld:
+      zone: public
+      service: http
+      permanent: true
+      state: enabled
+
+  - name: allow https traffic in public zone
+    ansible.posix.firewalld:
+      zone: public
+      service: https
+      permanent: true
+      state: enabled
+
+  - name: add source to internal zone
+    ansible.builtin.command: firewall-cmd --zone=internal --add-source=192.168.0.0/24 --permanent
+
+  - name: reload firewalld
+    ansible.builtin.command: firewall-cmd --reload