T9393: new rolesmain

2 files changed, 45 insertions, 0 deletions

diff --git a/roles/firewall/tasks/main.yml b/roles/firewall/tasks/main.yml
new file mode 100644
index 0000000..fe99b15
--- /dev/null
+++ b/roles/firewall/tasks/main.yml
@@ -0,0 +1,22 @@
+---
+- name: Create firewall groups
+  vyos.vyos.vyos_firewall_global:
+    config: "{{ lookup('ansible.builtin.template', 'groups.yml.j2') | from_yaml }}"
+    state: "{{ _firewall_state }}"
+  register: _firewall_r_groups
+  when: firewall_groups | dict2items | map(attribute='value') | select | list | length > 0
+
+- name: Configure the input, forward and output filters
+  vyos.vyos.vyos_firewall_rules:
+    config: "{{ lookup('ansible.builtin.template', 'rules.yml.j2') | from_yaml }}"
+    state: "{{ _firewall_state }}"
+  register: _firewall_r_rules
+  when: (firewall_ipv4 | length > 0) or (firewall_ipv6 | length > 0)
+
+- name: Collect rendered commands  # noqa: var-naming[no-role-prefix] - shared across roles by design
+  ansible.builtin.set_fact:
+    vyos_blueprints_rendered: >-
+      {{ vyos_blueprints_rendered | default([])
+         + ([_firewall_r_groups, _firewall_r_rules]
+            | selectattr('rendered', 'defined') | map(attribute='rendered') | flatten) }}
+  when: vyos_blueprints_render_only | default(false) | bool
diff --git a/roles/firewall/tasks/verify.yml b/roles/firewall/tasks/verify.yml
new file mode 100644
index 0000000..c2e3281
--- /dev/null
+++ b/roles/firewall/tasks/verify.yml
@@ -0,0 +1,23 @@
+---
+- name: Read the firewall
+  vyos.vyos.vyos_command:
+    commands:
+      - show firewall
+  register: _firewall_v
+
+- name: Every configured filter is active with its rules
+  ansible.builtin.assert:
+    that: >-
+      _firewall_v.stdout[0] is search((item.afi | upper | replace('V', 'v')) ~ ' Firewall "' ~ item.chain ~ ' filter"')
+    fail_msg: "{{ item.afi }} {{ item.chain }} filter is not active"
+    quiet: true
+  loop: >-
+    {%- set out = [] -%}
+    {%- for afi, filters in [('ipv4', firewall_ipv4), ('ipv6', firewall_ipv6)] -%}
+    {%-   for chain in ['input', 'forward', 'output'] if filters[chain] is defined and filters[chain] -%}
+    {%-     set _ = out.append({'afi': afi, 'chain': chain}) -%}
+    {%-   endfor -%}
+    {%- endfor -%}
+    {{ out }}
+  loop_control:
+    label: "{{ item.afi }} {{ item.chain }}"