---
# This task is used to set very simple firewall rules, allowing
# everything from a set of hosts and denying everything but ssh
# connections from any other host.
#
# Mandatory variables:
#
#
# Optional variables:
#
# trusted_hosts:  list of ip addresses. By default, all the hosts in
#                 the group `all`.
#
# default_accept: if equal to `1` or `true`, all connection *from
#                 internet* are accepted (but not from the internal
#

- name: Install iptables packages (Ubuntu)
  apt: pkg={{item}} update_cache=yes
  when: is_debian_or_ubuntu
  with_items:
    - iptables
    - iptables-persistent
  tags: iptables

- name: Install iptables package (CentOS)
  yum: pkg=iptables
  when: is_centos
  tags: iptables

- set_fact: destfile=/etc/iptables/rules.v4
  when: is_debian_or_ubuntu and is_docker_container is not defined
  tags: iptables

- set_fact: destfile=/etc/sysconfig/iptables
  when: is_centos
  tags: iptables

- set_fact: default_policy=ACCEPT
  when: 'default_accept is defined and default_accept.lower() in ["1", "true"]'
  tags: iptables

- set_fact: default_policy=DROP
  when: default_policy is not defined
  tags: iptables

- template: dest={{ destfile }} src=common/templates/etc/iptables.d/rules.v4.j2 owner=root group=root mode=0644
  when: is_docker_container is not defined
  notify: restart iptables
  tags: iptables
