68 lines
1.6 KiB
YAML
68 lines
1.6 KiB
YAML
---
|
|
# Firewall policy: default DROP, only SSH and the Minecraft port are exposed.
|
|
|
|
- name: Ensure firewalld is running and enabled
|
|
ansible.builtin.systemd:
|
|
name: firewalld
|
|
enabled: true
|
|
state: started
|
|
|
|
- name: Set the default zone target to DROP
|
|
ansible.posix.firewalld:
|
|
zone: "{{ firewall_zone }}"
|
|
target: "{{ firewall_zone_target }}"
|
|
permanent: true
|
|
immediate: true
|
|
state: present
|
|
|
|
- name: Allow SSH service
|
|
ansible.posix.firewalld:
|
|
zone: "{{ firewall_zone }}"
|
|
service: ssh
|
|
permanent: true
|
|
immediate: true
|
|
state: enabled
|
|
|
|
- name: Allow custom SSH port
|
|
ansible.posix.firewalld:
|
|
zone: "{{ firewall_zone }}"
|
|
port: "{{ ssh_port }}/tcp"
|
|
permanent: true
|
|
immediate: true
|
|
state: enabled
|
|
when: ssh_port != 22
|
|
|
|
- name: Allow Minecraft server port (TCP)
|
|
ansible.posix.firewalld:
|
|
zone: "{{ firewall_zone }}"
|
|
port: "{{ minecraft_port }}/tcp"
|
|
permanent: true
|
|
immediate: true
|
|
state: enabled
|
|
|
|
- name: Allow Minecraft server port (UDP)
|
|
ansible.posix.firewalld:
|
|
zone: "{{ firewall_zone }}"
|
|
port: "{{ minecraft_port }}/udp"
|
|
permanent: true
|
|
immediate: true
|
|
state: enabled
|
|
when: minecraft_udp | bool
|
|
|
|
- name: Allow Geyser Bedrock port (UDP)
|
|
ansible.posix.firewalld:
|
|
zone: "{{ firewall_zone }}"
|
|
port: "{{ geyser_port }}/udp"
|
|
permanent: true
|
|
immediate: true
|
|
state: enabled
|
|
when: enable_geyser | bool
|
|
|
|
- name: Allow ICMP echo (ping) for basic connectivity checks
|
|
ansible.posix.firewalld:
|
|
zone: "{{ firewall_zone }}"
|
|
icmp_block_inversion: true
|
|
permanent: true
|
|
immediate: true
|
|
state: present
|
|
when: firewall_allow_ping | bool |