66 lines
1.5 KiB
YAML
66 lines
1.5 KiB
YAML
- name: configure firewall rules
|
|
hosts: alma
|
|
become: true
|
|
|
|
tasks:
|
|
- name: confirm firewall is active
|
|
service:
|
|
name: firewalld
|
|
state: started
|
|
enabled: true
|
|
|
|
- name: allow ssh traffic in internal zone
|
|
ansible.posix.firewalld:
|
|
zone: internal
|
|
service: ssh
|
|
permanent: true
|
|
state: enabled
|
|
|
|
- name: allow calibre traffic in internal zone
|
|
ansible.posix.firewalld:
|
|
zone: internal
|
|
port: 8083/tcp
|
|
permanent: true
|
|
state: enabled
|
|
|
|
- name: allow jellyfin traffic in internal zone
|
|
ansible.posix.firewalld:
|
|
zone: internal
|
|
port: 8096/tcp
|
|
permanent: true
|
|
state: enabled
|
|
|
|
- name: allow http traffic in internal zone
|
|
ansible.posix.firewalld:
|
|
zone: internal
|
|
service: http
|
|
permanent: true
|
|
state: enabled
|
|
|
|
- name: allow https traffic in internal zone
|
|
ansible.posix.firewalld:
|
|
zone: internal
|
|
service: https
|
|
permanent: true
|
|
state: enabled
|
|
|
|
- name: allow http traffic in public zone
|
|
ansible.posix.firewalld:
|
|
zone: public
|
|
service: http
|
|
permanent: true
|
|
state: enabled
|
|
|
|
- name: allow https traffic in public zone
|
|
ansible.posix.firewalld:
|
|
zone: public
|
|
service: https
|
|
permanent: true
|
|
state: enabled
|
|
|
|
- name: add source to internal zone
|
|
ansible.builtin.command: firewall-cmd --zone=internal --add-source=192.168.0.0/24 --permanent
|
|
|
|
- name: reload firewalld
|
|
ansible.builtin.command: firewall-cmd --reload
|