Clément Désiles
c9e2ff930c
- Replace 'ufw disable && ufw --force enable' single-shot handler with a block that dry-runs the ruleset, disables, re-enables, then verifies ufw is active. No '&&' short-circuit, so failures are loud instead of leaving the host firewall-less. - Rename handler to 'Restart ufw (ip-forwarding settings changed)' to reflect that this is a full restart (required to pick up /etc/default/ufw and /etc/ufw/before.rules changes per ufw(8)). - Add NAT/masquerade tasks: enable ipv4 forwarding, set DEFAULT_FORWARD_POLICY=ACCEPT, and write a per-interface *nat block in /etc/ufw/before.rules. - Declare requires_ansible >=2.15 in meta/runtime.yml (handler uses block:, supported since 2.12; 2.15 is a safe modern floor). - README: document Ansible version requirement, port reservation rules, and Immich pgvector Q&A.
24 lines
844 B
YAML
24 lines
844 B
YAML
---
|
|
# UFW must be fully restarted (disable + enable) — not just reloaded — to pick
|
|
# up changes in /etc/default/ufw (DEFAULT_FORWARD_POLICY) and the *nat block
|
|
# in /etc/ufw/before.rules. See ufw(8) "RULE SYNTAX" → IP forwarding.
|
|
- name: Restart ufw (ip-forwarding settings changed)
|
|
block:
|
|
- name: Validate ufw ruleset before restart (dry-run)
|
|
ansible.builtin.command: ufw --dry-run reload
|
|
changed_when: false
|
|
|
|
- name: Disable ufw
|
|
ansible.builtin.command: ufw disable
|
|
changed_when: true
|
|
|
|
- name: Enable ufw
|
|
ansible.builtin.command: ufw --force enable
|
|
changed_when: true
|
|
|
|
- name: Verify ufw is active after restart
|
|
ansible.builtin.command: ufw status
|
|
register: ufw_status_after
|
|
changed_when: false
|
|
failed_when: "'Status: active' not in ufw_status_after.stdout"
|