# role to setup pf-firewall

- name: install iptables as dependency of pffirewall
  tags: pffirewall
  become: true
  package:
    name: iptables
    state: present

- name: install pffirewall
  tags: pffirewall
  become: true
  package:
    name: pffirewall
    state: present
  notify: "start and enable pffirewall"

- name: configure pffirewall
  tags: pffirewall
  become: true
  # per host system defined template can be stored under:
  # searing in the following order:
  # ./roles/general/pffirewall/templates/template-firewall.j2
  # ./roles/general/pffirewall/template-firewall.j2
  # ./internalit/roles/perfact-file/templates/template-firewall.j2  - custom template for system
  # ./internalit/roles/perfact-file/template-firewall.j2
  # ./roles/general/pffirewall/tasks/templates/template-firewall.j2  - general template
  # ./roles/general/pffirewall/tasks/template-firewall.j2
  template:
    src: template-firewall.j2
    dest: /etc/perfact/pffirewall/{{ inventory_hostname }}-firewall.sh
  notify:
    - "restart pffirewall"
    - "start and enable pffirewall"

- name: configure pffirewall in /etc/default/pffirewall FIREWALL_SCRIPT
  tags: pffirewall
  become: true
  replace:
    path: /etc/default/pffirewall
    regexp: 'FIREWALL_SCRIPT=".*\.sh"'
    replace: 'FIREWALL_SCRIPT="{{ inventory_hostname }}-firewall.sh"'
    backup: true
  notify:
    - "restart pffirewall"
    - "start and enable pffirewall"

- name: configure pffirewall in /etc/default/pffirewall MIN_LINE_AMOUNT
  tags: pffirewall
  become: true
  replace:
    path: /etc/default/pffirewall
    regexp: 'MIN_LINE_AMOUNT=100'
    replace: 'MIN_LINE_AMOUNT=60'
    backup: true
