- name: Getting public IP addresses
  block:
    - name: Getting public IPv4 address
      community.general.ipify_facts:
        validate_certs: false
        timeout: 20
    - name: Getting public IPv6 address
      when: ipv6_enabled
      ansible.builtin.shell:
        cmd: curl -6 icanhazip.com
      register: ipify_public_ip6
- name: Getting available network interfaces
  ansible.builtin.shell:
    cmd: "ip link show | awk '/^[0-9]+: [a-z]/ { print $2 }' | grep -vE 'lo[0-9]*|wg[0-9]+-mullvad' | sed 's/://g'"
  register: intrfaces
- name: Turning acquired network interfaces into list
  ansible.builtin.set_fact:
    main_interfaces: "{{ intrfaces.stdout | replace('\n', ' ') | split(' ') }}"
- name: Enabling UFW startup
  become: true
  ansible.builtin.systemd_service:
    name: ufw
    scope: system
    state: started
    enabled: true
- name: Enabling firewall startup
  community.general.ufw:
    state: enabled
- name: Pre-emptively establishing firewall rules for loopback interface
  become: true
  block:
    - name: Pre-emptively allowing inbound connections on loopback interface
      community.general.ufw:
        rule: allow
        direction: in
        interface: lo
    - name: Allowing outbound connections on loopback interface
      community.general.ufw:
        rule: allow
        direction: out
        interface: lo
    - name: Denying inbound connections from loopback address on rest of interfaces
      community.general.ufw:
        rule: deny
        direction: in
        interface: "{{ item[1] }}"
        from_ip: "{{ item[0] }}"
      loop: "{{ ['127.0.0.0/8', '::/128'] | product(main_interfaces) }}"
- name: Pre-emptively allowing rate-limited inbound SSH
  become: true
  community.general.ufw:
    rule: allow
    name: ssh
- name: Crafting additional exceptions to the inbound default policy
  become: true
  community.general.ufw:
    rule: allow
    direction: in
    proto: "{{ item[1].protocol | default('tcp') }}"
    interface: "{{ item[1].interface | default(item[0]) }}"
    port: "{{ item[1].port }}"
  loop: "{{ main_interfaces | product(iptables.allow.inbound) }}"
- name: Setting default policy for inbound connections
  become: true
  community.general.ufw:
    direction: incoming
    default: deny
- name: Setting default policy for outbound connections
  become: true
  community.general.ufw:
    direction: outgoing
    default: allow