- name: configure firewall rules
  hosts: wireguard
  become: true

  tasks:
  - name: confirm firewall is active
    service:
      name: firewalld
      state: started
      enabled: true

  - name: run script to remove all pre-configured services in public zone
    script: ../firewall/remove_services.sh

  - name: allow ssh traffic in internal zone
    ansible.posix.firewalld:
      zone: internal
      service: ssh
      permanent: true
      state: enabled

  - name: allow wireguard traffic in internal zone
    ansible.posix.firewalld:
      zone: internal
      service: wireguard
      permanent: true
      state: enabled

  - name: allow wireguard traffic in public zone
    ansible.posix.firewalld:
      zone: public
      service: wireguard
      permanent: true
      state: enabled

  - name: add source to internal zone
    ansible.builtin.command: firewall-cmd --zone=internal --add-source=192.168.0.0/24 --permanent

  - name: assign wg0 to internal zone on firewall
    ansible.builtin.command: firewall-cmd --zone=internal --add-interface=wg0 --permanent

  - name: apply source NAT to internal zone
    ansible.builtin.command: firewall-cmd --zone=internal --add-masquerade --permanent

  - name: reload firewalld
    ansible.builtin.command: firewall-cmd --reload