diff --git a/README.md b/README.md index 7313f91..619e8ad 100644 --- a/README.md +++ b/README.md @@ -22,15 +22,16 @@ PEP440 is the schema used to describe the versions of Ansible. ### Modules Name | Description --- | --- -[ansible.posix.acl](https://github.com/ansible-collections/ansible.posix/blob/main/docs/ansible.posix.acl_module.rst)|Set and retrieve file ACL information. -[ansible.posix.at](https://github.com/ansible-collections/ansible.posix/blob/main/docs/ansible.posix.at_module.rst)|Schedule the execution of a command or script file via the at command -[ansible.posix.authorized_key](https://github.com/ansible-collections/ansible.posix/blob/main/docs/ansible.posix.authorized_key_module.rst)|Adds or removes an SSH authorized key -[ansible.posix.mount](https://github.com/ansible-collections/ansible.posix/blob/main/docs/ansible.posix.mount_module.rst)|Control active and configured mount points -[ansible.posix.patch](https://github.com/ansible-collections/ansible.posix/blob/main/docs/ansible.posix.patch_module.rst)|Apply patch files using the GNU patch tool -[ansible.posix.seboolean](https://github.com/ansible-collections/ansible.posix/blob/main/docs/ansible.posix.seboolean_module.rst)|Toggles SELinux booleans -[ansible.posix.selinux](https://github.com/ansible-collections/ansible.posix/blob/main/docs/ansible.posix.selinux_module.rst)|Change policy and state of SELinux -[ansible.posix.synchronize](https://github.com/ansible-collections/ansible.posix/blob/main/docs/ansible.posix.synchronize_module.rst)|A wrapper around rsync to make common tasks in your playbooks quick and easy -[ansible.posix.sysctl](https://github.com/ansible-collections/ansible.posix/blob/main/docs/ansible.posix.sysctl_module.rst)|Manage entries in sysctl.conf. +[ansible.posix.acl](https://github.com/ansible-collections/ansible.posix/blob/master/docs/ansible.posix.acl_module.rst)|Set and retrieve file ACL information. +[ansible.posix.at](https://github.com/ansible-collections/ansible.posix/blob/master/docs/ansible.posix.at_module.rst)|Schedule the execution of a command or script file via the at command +[ansible.posix.authorized_key](https://github.com/ansible-collections/ansible.posix/blob/master/docs/ansible.posix.authorized_key_module.rst)|Adds or removes an SSH authorized key +[ansible.posix.firewalld](https://github.com/ansible-collections/ansible.posix/blob/master/docs/ansible.posix.firewalld_module.rst)|Manage arbitrary ports/services with firewalld +[ansible.posix.mount](https://github.com/ansible-collections/ansible.posix/blob/master/docs/ansible.posix.mount_module.rst)|Control active and configured mount points +[ansible.posix.patch](https://github.com/ansible-collections/ansible.posix/blob/master/docs/ansible.posix.patch_module.rst)|Apply patch files using the GNU patch tool +[ansible.posix.seboolean](https://github.com/ansible-collections/ansible.posix/blob/master/docs/ansible.posix.seboolean_module.rst)|Toggles SELinux booleans +[ansible.posix.selinux](https://github.com/ansible-collections/ansible.posix/blob/master/docs/ansible.posix.selinux_module.rst)|Change policy and state of SELinux +[ansible.posix.synchronize](https://github.com/ansible-collections/ansible.posix/blob/master/docs/ansible.posix.synchronize_module.rst)|A wrapper around rsync to make common tasks in your playbooks quick and easy +[ansible.posix.sysctl](https://github.com/ansible-collections/ansible.posix/blob/master/docs/ansible.posix.sysctl_module.rst)|Manage entries in sysctl.conf. @@ -105,4 +106,4 @@ None GNU General Public License v3.0 or later. -See [COPYING](https://www.gnu.org/licenses/gpl-3.0.txt) to see the full text. +See [COPYING](https://www.gnu.org/licenses/gpl-3.0.txt) to see the full text. \ No newline at end of file diff --git a/docs/ansible.posix.firewalld_module.rst b/docs/ansible.posix.firewalld_module.rst new file mode 100644 index 0000000..7cd0195 --- /dev/null +++ b/docs/ansible.posix.firewalld_module.rst @@ -0,0 +1,383 @@ +.. _ansible.posix.firewalld_module: + + +*********************** +ansible.posix.firewalld +*********************** + +**Manage arbitrary ports/services with firewalld** + + + +.. contents:: + :local: + :depth: 1 + + +Synopsis +-------- +- This module allows for addition or deletion of services and ports (either TCP or UDP) in either running or permanent firewalld rules. + + + +Requirements +------------ +The below requirements are needed on the host that executes this module. + +- firewalld >= 0.2.11 + + +Parameters +---------- + +.. raw:: html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
ParameterChoices/DefaultsComments
+
+ icmp_block + +
+ string +
+ 		+ +
The ICMP block you would like to add/remove to/from a zone in firewalld.
+
+
+ icmp_block_inversion + +
+ string +
+ 		+ +
Enable/Disable inversion of ICMP blocks for a zone in firewalld.
+
+
+ immediate + +
+ boolean +
+ 		+
    Choices: +
  • no ←
    • +
  • yes
    • +
+ 		+
Should this configuration be applied immediately, if set as permanent.
+
+
+ interface + +
+ string +
+ 		+ +
The interface you would like to add/remove to/from a zone in firewalld.
+
+
+ masquerade + +
+ string +
+ 		+ +
The masquerade setting you would like to enable/disable to/from zones within firewalld.
+
+
+ offline + +
+ boolean +
+ 		+
    Choices: +
  • no
    • +
  • yes
    • +
+ 		+
Whether to run this module even when firewalld is offline.
+
+
+ permanent + +
+ boolean +
+ 		+
    Choices: +
  • no
    • +
  • yes
    • +
+ 		+
Should this configuration be in the running firewalld configuration or persist across reboots.
+
As of Ansible 2.3, permanent operations can operate on firewalld configs when it is not running (requires firewalld >= 3.0.9).
+
Note that if this is no, immediate is assumed yes.
+
+
+ port + +
+ string +
+ 		+ +
Name of a port or port range to add/remove to/from firewalld.
+
Must be in the form PORT/PROTOCOL or PORT-PORT/PROTOCOL for port ranges.
+
+
+ rich_rule + +
+ string +
+ 		+ +
Rich rule to add/remove to/from firewalld.
+
+
+ service + +
+ string +
+ 		+ +
Name of a service to add/remove to/from firewalld.
+
The service must be listed in output of firewall-cmd --get-services.
+
+
+ source + +
+ string +
+ 		+ +
The source/network you would like to add/remove to/from firewalld.
+
+
+ state + +
+ string + / required
+ 		+
    Choices: +
  • absent
    • +
  • disabled
    • +
  • enabled
    • +
  • present
    • +
+ 		+
Enable or disable a setting.
+
For ports: Should this port accept (enabled) or reject (disabled) connections.
+
The states present and absent can only be used in zone level operations (i.e. when no other parameters but zone and state are set).
+
+
+ timeout + +
+ integer +
+ 		+ Default:
0
+ 		+
The amount of time the rule should be in effect for when non-permanent.
+
+
+ zone + +
+ string +
+ 		+ +
The firewalld zone to add/remove to/from.
+
Note that the default zone can be configured per system but public is default from upstream.
+
Available choices can be extended based on per-system configs, listed here are "out of the box" defaults.
+
Possible values include block, dmz, drop, external, home, internal, public, trusted, work.
+
+
+ + +Notes +----- + +.. note:: + - Not tested on any Debian based system. + - Requires the python2 bindings of firewalld, which may not be installed by default. + - For distributions where the python2 firewalld bindings are unavailable (e.g Fedora 28 and later) you will have to set the ansible_python_interpreter for these hosts to the python3 interpreter path and install the python3 bindings. + - Zone transactions (creating, deleting) can be performed by using only the zone and state parameters "present" or "absent". Note that zone transactions must explicitly be permanent. This is a limitation in firewalld. This also means that you will have to reload firewalld after adding a zone that you wish to perform immediate actions on. The module will not take care of this for you implicitly because that would undo any previously performed immediate actions which were not permanent. Therefore, if you require immediate access to a newly created zone it is recommended you reload firewalld immediately after the zone creation returns with a changed state and before you perform any other immediate, non-permanent actions on that zone. + + + +Examples +-------- + +.. code-block:: yaml+jinja + + + - name: permit traffic in default zone for https service + ansible.posix.firewalld: + service: https + permanent: yes + state: enabled + + - name: do not permit traffic in default zone on port 8081/tcp + ansible.posix.firewalld: + port: 8081/tcp + permanent: yes + state: disabled + + - ansible.posix.firewalld: + port: 161-162/udp + permanent: yes + state: enabled + + - ansible.posix.firewalld: + zone: dmz + service: http + permanent: yes + state: enabled + + - ansible.posix.firewalld: + rich_rule: rule service name="ftp" audit limit value="1/m" accept + permanent: yes + state: enabled + + - ansible.posix.firewalld: + source: 192.0.2.0/24 + zone: internal + state: enabled + + - ansible.posix.firewalld: + zone: trusted + interface: eth2 + permanent: yes + state: enabled + + - ansible.posix.firewalld: + masquerade: yes + state: enabled + permanent: yes + zone: dmz + + - ansible.posix.firewalld: + zone: custom + state: present + permanent: yes + + - ansible.posix.firewalld: + zone: drop + state: enabled + permanent: yes + icmp_block_inversion: yes + + - ansible.posix.firewalld: + zone: drop + state: enabled + permanent: yes + icmp_block: echo-request + + - name: Redirect port 443 to 8443 with Rich Rule + ansible.posix.firewalld: + rich_rule: rule family=ipv4 forward-port port=443 protocol=tcp to-port=8443 + zone: public + permanent: yes + immediate: yes + state: enabled + + + + + +Status +------ + + +Authors +~~~~~~~ + +- Adam Miller (@maxamillion) + + diff --git a/docs/ansible.posix.patch_module.rst b/docs/ansible.posix.patch_module.rst index 59d5f51..9289047 100644 --- a/docs/ansible.posix.patch_module.rst +++ b/docs/ansible.posix.patch_module.rst @@ -105,6 +105,25 @@ Parameters
The names of the files to be patched are usually taken from the patch file, but if there's just one file to be patched it can specified with this option.

aliases: originalfile
+ + + +
+ ignore_whitespace + +
+ boolean +
+ + + + + +
Setting to yes will ignore white space changes between patch and input..
+ diff --git a/galaxy.yml b/galaxy.yml index 58775c0..ff3db68 100644 --- a/galaxy.yml +++ b/galaxy.yml @@ -1,10 +1,10 @@ namespace: ansible name: posix -version: 1.0.0 +version: 1.1.0 readme: README.md authors: - Ansible (github.com/ansible) -description: null +description: Ansible Collection targeting POSIX and POSIX-ish platforms. license_file: COPYING tags: [posix, networking, shell, unix] dependencies: {}