new major update

roles/init-server/tasks/contingent/pkg/ufw.yml

@@ -0,0 +1,72 @@
+- name: Getting public IP addresses
+  block:
+    - name: Getting public IPv4 address
+      community.general.ipify_facts:
+        validate_certs: false
+        timeout: 20
+    - name: Getting public IPv6 address
+      when: ipv6_enabled
+      ansible.builtin.shell:
+        cmd: curl -6 icanhazip.com
+      register: ipify_public_ip6
+- name: Getting available network interfaces
+  ansible.builtin.shell:
+    cmd: "ip link show | awk '/^[0-9]+: [a-z]/ { print $2 }' | grep -vE 'lo[0-9]*|wg[0-9]+-mullvad' | sed 's/://g'"
+  register: intrfaces
+- name: Turning acquired network interfaces into list
+  ansible.builtin.set_fact:
+    main_interfaces: "{{ intrfaces.stdout | replace('\n', ' ') | split(' ') }}"
+- name: Enabling UFW startup
+  become: true
+  ansible.builtin.systemd_service:
+    name: ufw
+    scope: system
+    state: started
+    enabled: true
+- name: Enabling firewall startup
+  community.general.ufw:
+    state: enabled
+- name: Pre-emptively establishing firewall rules for loopback interface
+  become: true
+  block:
+    - name: Pre-emptively allowing inbound connections on loopback interface
+      community.general.ufw:
+        rule: allow
+        direction: in
+        interface: lo
+    - name: Allowing outbound connections on loopback interface
+      community.general.ufw:
+        rule: allow
+        direction: out
+        interface: lo
+    - name: Denying inbound connections from loopback address on rest of interfaces
+      community.general.ufw:
+        rule: deny
+        direction: in
+        interface: "{{ item[1] }}"
+        from_ip: "{{ item[0] }}"
+      loop: "{{ ['127.0.0.0/8', '::/128'] | product(main_interfaces) }}"
+- name: Pre-emptively allowing rate-limited inbound SSH
+  become: true
+  community.general.ufw:
+    rule: allow
+    name: ssh
+- name: Crafting additional exceptions to the inbound default policy
+  become: true
+  community.general.ufw:
+    rule: allow
+    direction: in
+    proto: "{{ item[1].protocol | default('tcp') }}"
+    interface: "{{ item[1].interface | default(item[0]) }}"
+    port: "{{ item[1].port }}"
+  loop: "{{ main_interfaces | product(iptables.allow.inbound) }}"
+- name: Setting default policy for inbound connections
+  become: true
+  community.general.ufw:
+    direction: incoming
+    default: deny
+- name: Setting default policy for outbound connections
+  become: true
+  community.general.ufw:
+    direction: outgoing
+    default: allow