Make reset configurable? about ansible-ufw HOT 4 CLOSED

@smiller171 the reset include already has the ufw-reset tag

Generally: I added the reset to make it easier to manage the rules but since this seems to be unwanted in some cases I added the ufw_reset option. It's yes by default but you can set it to no. You'll then have to make sure you remove rules by yourself by setting a rule's delete flag.

from ansible-ufw.

Hi Perry,

must admit, haven't had this scenario yet but let's try to figure that out :)

Your right, setting the hash_behaviour is a absolute no go except for really small setups where you know nothing unexpected is gonna happen. The alternative is to use it within jinja templates for hashes or in this case arrays:

    ...
    ufw_rules_foo:
      - { from_ip: '127.0.0.1/8' }
      - { from_ip: '127.0.42.0/24', rule: deny }
    ufw_rules_bar:
      - { port: 80, rule: allow }
    ufw_rules: "{{ ufw_rules_foo + ufw_rules_bar}}"
    ...

One option would be to use multiple playbooks and run the role only for a specific tag:

- hosts: all
  roles:
    - {role: franklinkim.ufw, tags: ['ufw-reset']}
    ...

- hosts: db
  roles:
    - {role: franklinkim.ufw, tags: ['ufw-config']}
    ...

from ansible-ufw.

idempotence test fails

TASK [franklinkim.ufw : Resetting firewall] ************************************

changed: [localhost]

Could the firewall only be reset if the rule(s) change(s)?

from ansible-ufw.

While I think it should be idempotent, for the context of this specific issue could you tag the reset include and allow a user to run with --skip-tags reset?

from ansible-ufw.