T9393: new rolesmain

1 files changed, 35 insertions, 0 deletions

diff --git a/roles/bridge_firewall/tasks/main.yml b/roles/bridge_firewall/tasks/main.yml
new file mode 100644
index 0000000..d947258
--- /dev/null
+++ b/roles/bridge_firewall/tasks/main.yml
@@ -0,0 +1,35 @@
+---
+- name: Set member interface descriptions
+  vyos.vyos.vyos_interfaces:
+    config: "{{ _bridge_firewall_member_descriptions }}"
+    state: "{{ _bridge_firewall_state }}"
+  register: _bridge_firewall_r_ifaces
+  when: _bridge_firewall_member_descriptions | length > 0
+
+- name: Create bridges, interface groups and the bridge firewall
+  # No vyos.vyos resource module covers bridges, interface groups or the
+  # bridge firewall yet, so these go through vyos_config.
+  vyos.vyos.vyos_config:
+    lines: "{{ _bridge_firewall_cli_lines }}"
+  register: _bridge_firewall_r_cli
+  when: not (vyos_blueprints_render_only | default(false) | bool)
+
+- name: Configure the IPv4 input and forward filters
+  vyos.vyos.vyos_firewall_rules:
+    config: "{{ _bridge_firewall_ipv4 }}"
+    state: "{{ _bridge_firewall_state }}"
+  vars:
+    _bridge_firewall_ipv4: "{{ lookup('ansible.builtin.template', 'ipv4_rules.yml.j2') | from_yaml }}"
+  register: _bridge_firewall_r_ipv4
+  when: >-
+    bridge_firewall_bridges | selectattr('ip_forward', 'defined') | list | length > 0
+    or bridge_firewall_bridges | selectattr('router_access', 'defined') | list | length > 0
+
+- name: Collect rendered commands  # noqa: var-naming[no-role-prefix] - shared across roles by design
+  ansible.builtin.set_fact:
+    vyos_blueprints_rendered: >-
+      {{ vyos_blueprints_rendered | default([])
+         + (_bridge_firewall_r_ifaces.rendered | default([]))
+         + _bridge_firewall_cli_lines
+         + (_bridge_firewall_r_ipv4.rendered | default([])) }}
+  when: vyos_blueprints_render_only | default(false) | bool