initial opencode commit

roles/firewall/tasks/main.yml

@@ -0,0 +1,68 @@
+---
+# Firewall policy: default DROP, only SSH and the Minecraft port are exposed.
+
+- name: Ensure firewalld is running and enabled
+  ansible.builtin.systemd:
+    name: firewalld
+    enabled: true
+    state: started
+
+- name: Set the default zone target to DROP
+  ansible.posix.firewalld:
+    zone: "{{ firewall_zone }}"
+    target: "{{ firewall_zone_target }}"
+    permanent: true
+    immediate: true
+    state: present
+
+- name: Allow SSH service
+  ansible.posix.firewalld:
+    zone: "{{ firewall_zone }}"
+    service: ssh
+    permanent: true
+    immediate: true
+    state: enabled
+
+- name: Allow custom SSH port
+  ansible.posix.firewalld:
+    zone: "{{ firewall_zone }}"
+    port: "{{ ssh_port }}/tcp"
+    permanent: true
+    immediate: true
+    state: enabled
+  when: ssh_port != 22
+
+- name: Allow Minecraft server port (TCP)
+  ansible.posix.firewalld:
+    zone: "{{ firewall_zone }}"
+    port: "{{ minecraft_port }}/tcp"
+    permanent: true
+    immediate: true
+    state: enabled
+
+- name: Allow Minecraft server port (UDP)
+  ansible.posix.firewalld:
+    zone: "{{ firewall_zone }}"
+    port: "{{ minecraft_port }}/udp"
+    permanent: true
+    immediate: true
+    state: enabled
+  when: minecraft_udp | bool
+
+- name: Allow Geyser Bedrock port (UDP)
+  ansible.posix.firewalld:
+    zone: "{{ firewall_zone }}"
+    port: "{{ geyser_port }}/udp"
+    permanent: true
+    immediate: true
+    state: enabled
+  when: enable_geyser | bool
+
+- name: Allow ICMP echo (ping) for basic connectivity checks
+  ansible.posix.firewalld:
+    zone: "{{ firewall_zone }}"
+    icmp_block_inversion: true
+    permanent: true
+    immediate: true
+    state: present
+  when: firewall_allow_ping | bool