Rename configure_firewall role

This commit is contained in:
Ivo C.S. Wingelaar 2024-10-13 13:35:16 +02:00
parent 5542a21301
commit d0746b2f1b
Signed by: ivo
GPG key ID: ABBED434F58D0AA3
6 changed files with 13 additions and 13 deletions

View file

@ -1,3 +0,0 @@
---
sce_nft_table_name: sce_table
sce_nft_table_filename: sce-port-mapping

View file

@ -0,0 +1,3 @@
---
firewall_nft_table_name: sce_table
firewall_nft_table_filename: sce-port-mapping

View file

@ -5,5 +5,5 @@
- name: Reload port mapping service - name: Reload port mapping service
ansible.builtin.systemd_service: ansible.builtin.systemd_service:
name: "{{ sce_nft_table_filename }}.service" name: "{{ firewall_nft_table_filename }}.service"
state: reloaded state: reloaded

View file

@ -7,7 +7,7 @@
- name: Install SCE port mapping rules - name: Install SCE port mapping rules
ansible.builtin.template: ansible.builtin.template:
src: nft.conf.j2 src: nft.conf.j2
dest: /etc/{{ sce_nft_table_filename }}.conf dest: /etc/{{ firewall_nft_table_filename }}.conf
mode: "0755" mode: "0755"
validate: /usr/sbin/nft -cf %s validate: /usr/sbin/nft -cf %s
notify: Reload port mapping service notify: Reload port mapping service
@ -15,7 +15,7 @@
- name: Install SCE port mapping systemd service - name: Install SCE port mapping systemd service
ansible.builtin.template: ansible.builtin.template:
src: nft.service.j2 src: nft.service.j2
dest: /etc/systemd/system/{{ sce_nft_table_filename }}.service dest: /etc/systemd/system/{{ firewall_nft_table_filename }}.service
mode: "0644" mode: "0644"
notify: Reload systemd daemon notify: Reload systemd daemon
@ -25,6 +25,6 @@
- name: Ensure nft SCE port mapping service is started and enabled - name: Ensure nft SCE port mapping service is started and enabled
ansible.builtin.systemd_service: ansible.builtin.systemd_service:
name: "{{ sce_nft_table_filename }}.service" name: "{{ firewall_nft_table_filename }}.service"
state: started state: started
enabled: true enabled: true

View file

@ -10,10 +10,10 @@
# Flush and recreate the entire table # Flush and recreate the entire table
# https://unix.stackexchange.com/questions/537030/nftables-flush-delete-when-changing-or-creating-new-table # https://unix.stackexchange.com/questions/537030/nftables-flush-delete-when-changing-or-creating-new-table
table inet {{ sce_nft_table_name }} table inet {{ firewall_nft_table_name }}
flush table inet {{ sce_nft_table_name }} flush table inet {{ firewall_nft_table_name }}
table inet {{ sce_nft_table_name }} { table inet {{ firewall_nft_table_name }} {
chain sce_port_mapping { chain sce_port_mapping {
type nat hook prerouting priority filter + 1; type nat hook prerouting priority filter + 1;
policy accept; policy accept;

View file

@ -14,9 +14,9 @@ RemainAfterExit=yes
StandardInput=null StandardInput=null
ProtectSystem=full ProtectSystem=full
ProtectHome=true ProtectHome=true
ExecStart=/usr/sbin/nft -f /etc/{{ sce_nft_table_filename }}.conf ExecStart=/usr/sbin/nft -f /etc/{{ firewall_nft_table_filename }}.conf
ExecReload=/usr/sbin/nft -f /etc/{{ sce_nft_table_filename }}.conf ExecReload=/usr/sbin/nft -f /etc/{{ firewall_nft_table_filename }}.conf
ExecStop=/usr/sbin/nft delete table inet {{ sce_nft_table_name }} ExecStop=/usr/sbin/nft delete table inet {{ firewall_nft_table_name }}
[Install] [Install]
WantedBy=sysinit.target WantedBy=sysinit.target