---
# Firewall policy: default DROP, only SSH and the Minecraft port are exposed.

- name: Ensure firewalld is running and enabled
  ansible.builtin.systemd:
    name: firewalld
    enabled: true
    state: started

- name: Set the default zone target to DROP
  ansible.posix.firewalld:
    zone: "{{ firewall_zone }}"
    target: "{{ firewall_zone_target }}"
    permanent: true
    immediate: true
    state: present

- name: Allow SSH service
  ansible.posix.firewalld:
    zone: "{{ firewall_zone }}"
    service: ssh
    permanent: true
    immediate: true
    state: enabled

- name: Allow custom SSH port
  ansible.posix.firewalld:
    zone: "{{ firewall_zone }}"
    port: "{{ ssh_port }}/tcp"
    permanent: true
    immediate: true
    state: enabled
  when: ssh_port != 22

- name: Allow Minecraft server port (TCP)
  ansible.posix.firewalld:
    zone: "{{ firewall_zone }}"
    port: "{{ minecraft_port }}/tcp"
    permanent: true
    immediate: true
    state: enabled

- name: Allow Minecraft server port (UDP)
  ansible.posix.firewalld:
    zone: "{{ firewall_zone }}"
    port: "{{ minecraft_port }}/udp"
    permanent: true
    immediate: true
    state: enabled
  when: minecraft_udp | bool

- name: Allow Geyser Bedrock port (UDP)
  ansible.posix.firewalld:
    zone: "{{ firewall_zone }}"
    port: "{{ geyser_port }}/udp"
    permanent: true
    immediate: true
    state: enabled
  when: enable_geyser | bool

- name: Allow ICMP echo (ping) for basic connectivity checks
  ansible.posix.firewalld:
    zone: "{{ firewall_zone }}"
    icmp_block_inversion: true
    permanent: true
    immediate: true
    state: present
  when: firewall_allow_ping | bool