- name: configure firewall rules
  hosts: alma
  become: true

  tasks:
  - name: confirm firewall is active
    service:
      name: firewalld
      state: started
      enabled: true

  - name: allow ssh traffic in internal zone
    ansible.posix.firewalld:
      zone: internal
      service: ssh
      permanent: true
      state: enabled

  - name: allow calibre traffic in internal zone
    ansible.posix.firewalld:
      zone: internal
      port: 8083/tcp
      permanent: true
      state: enabled

  - name: allow jellyfin traffic in internal zone
    ansible.posix.firewalld:
      zone: internal
      port: 8096/tcp
      permanent: true
      state: enabled

  - name: allow http traffic in internal zone
    ansible.posix.firewalld:
      zone: internal
      service: http
      permanent: true
      state: enabled

  - name: allow https traffic in internal zone
    ansible.posix.firewalld:
      zone: internal
      service: https
      permanent: true
      state: enabled

  - name: allow http traffic in public zone
    ansible.posix.firewalld:
      zone: public
      service: http
      permanent: true
      state: enabled

  - name: allow https traffic in public zone
    ansible.posix.firewalld:
      zone: public
      service: https
      permanent: true
      state: enabled

  - name: add source to internal zone
    ansible.builtin.command: firewall-cmd --zone=internal --add-source=192.168.0.0/24 --permanent

  - name: reload firewalld
    ansible.builtin.command: firewall-cmd --reload