Add pflog configuration.

ansible/roles/firewall/defaults/main.yaml

@@ -0,0 +1 @@
+pflog_conf: []

ansible/roles/firewall/handlers/main.yaml

@@ -3,3 +3,14 @@
   service:
     name: pf
     state: reloaded
+
+- name: restart pflog
+  when: is_pf_running.rc == 0
+  service:
+    name: pflog
+    state: restarted
+
+- name: stop pflog
+  service:
+    name: pflog
+    state: stopped

ansible/roles/firewall/tasks/freebsd.yaml

@@ -27,3 +27,43 @@
   register: is_pf_running
   failed_when: is_pf_running.rc != 0
   ignore_errors: true
+
+- name: Enable pflog
+  notify: restart pflog
+  community.general.sysrc:
+    name: pflog_enable
+    value: "YES"
+    path: /etc/rc.conf.d/pflog
+  when: pflog_conf|length > 0
+
+- name: Disable pflog
+  notify: stop pflog
+  community.general.sysrc:
+    name: pflog_enable
+    value: "NO"
+    path: /etc/rc.conf.d/pflog
+  when: pflog_conf|length == 0
+
+- name: Set pflog instances
+  notify: restart pflog
+  community.general.sysrc:
+    name: pflog_instances
+    value: "{{ pflog_conf|community.general.json_query('[].name')|join(' ') }}"
+    path: /etc/rc.conf.d/pflog
+  when: pflog_conf|length > 0
+
+- name: Remove pflog instances
+  notify: stop pflog
+  community.general.sysrc:
+    name: jail_list
+    state: absent
+    path: /etc/rc.conf.d/pflog
+  when: pflog_conf|length == 0
+
+- name: Set pflog device names
+  notify: restart pflog
+  community.general.sysrc:
+    name: "pflog_{{item.name}}_dev"
+    value: "{{ item.dev }}"
+    path: /etc/rc.conf.d/pflog
+  loop: "{{ pflog_conf }}"