13_bastion_networking.yml

---
- name: Bastion networking playbook
  hosts: bastion
  become: true
  tasks:
    - name: Checking Bastion internal network interfaces
      ansible.builtin.fail:
        msg: "{{ host_interface }} not found in {{ ansible_facts.interfaces }}"
      when: host_interface not in ansible_facts.interfaces

    - name: Ensure firewalld is enabled and running
      ansible.builtin.service:
        name: firewalld
        state: started
        enabled: true

    # - name: Adding interface {{ host_interface }} to internal zone
    #   community.general.nmcli:
    #     conn_name: "{{ host_interface }}"
    #     zone: internal
    #     state: present
    - name: Adding interface to internal zone # noqa no-changed-when
      ansible.builtin.command: nmcli con mod {{ host_interface }} connection.zone internal

    - name: Adding Bastion interface to firewall internal zone
      ansible.posix.firewalld:
        zone: internal
        interface: "{{ host_interface }}"
        permanent: true
        state: enabled

    - name: Allow required service for internal zone
      ansible.posix.firewalld:
        zone: internal
        state: enabled
        permanent: true
        service: "{{ item }}"
      loop: "{{ services }}"

    - name: Allow tftp and pxe ports
      ansible.posix.firewalld:
        zone: internal
        state: enabled
        permanent: true
        port: "{{ item }}"
      loop: "{{ ports }}"

    - name: Reload Bastion firewalld service
      ansible.builtin.service:
        name: firewalld
        state: restarted