1 files changed, 34 insertions, 0 deletions
diff --git a/roles/zone_firewall/tasks/main.yml b/roles/zone_firewall/tasks/main.yml
new file mode 100644
index 0000000..469dc24
--- /dev/null
+++ b/roles/zone_firewall/tasks/main.yml
@@ -0,0 +1,34 @@
+---
+- name: Check zones and policies
+  ansible.builtin.assert:
+    that:
+      - zone_firewall_zones | selectattr('local', 'defined') | selectattr('local') | list | length <= 1
+      - (zone_firewall_policies | map(attribute='from') | list + zone_firewall_policies | map(attribute='to') | list)
+        | difference(_zone_firewall_names) | length == 0
+      - not (zone_firewall_base_rules | bool)
+        or (zone_firewall_policies | map(attribute='rules', default=[]) | flatten
+            | map(attribute='number') | select('in', [1, 2]) | list | length == 0)
+    fail_msg: >-
+      At most one local zone; every policy must reference defined zones;
+      rule numbers 1 and 2 are reserved for the base rules.
+    quiet: true
+
+- name: Create one ruleset per zone-pair-direction
+  vyos.vyos.vyos_firewall_rules:
+    config: "{{ lookup('ansible.builtin.template', 'firewall_rules.yml.j2') | from_yaml }}"
+    state: "{{ _zone_firewall_state }}"
+  register: _zone_firewall_r_rules
+
+- name: Define zones and bind the rulesets
+  vyos.vyos.vyos_firewall_global:
+    config: "{{ lookup('ansible.builtin.template', 'zones.yml.j2') | from_yaml }}"
+    state: "{{ _zone_firewall_state }}"
+  register: _zone_firewall_r_zones
+
+- name: Collect rendered commands  # noqa: var-naming[no-role-prefix] - shared across roles by design
+  ansible.builtin.set_fact:
+    vyos_blueprints_rendered: >-
+      {{ vyos_blueprints_rendered | default([])
+         + ([_zone_firewall_r_rules, _zone_firewall_r_zones]
+            | selectattr('rendered', 'defined') | map(attribute='rendered') | flatten) }}
+  when: vyos_blueprints_render_only | default(false) | bool