Create a firewall role that installs a pf.conf on FreeBSD.

Does not yet configure pflog nor does it do anything on Linux.

ansible/roles/firewall/tasks/common.yaml

@@ -0,0 +1,14 @@
+- import_tasks: tasks/freebsd.yaml
+  when: 'os_flavor == "freebsd"'
+
+- import_tasks: tasks/linux.yaml
+  when: 'os_flavor == "linux"'
+
+- include_tasks:
+    file: tasks/peruser.yaml
+    apply:
+      become: yes
+      become_user: "{{ initialize_user }}"
+  loop: "{{ users | dict2items | community.general.json_query('[?value.initialize==`true`].key') }}"
+  loop_control:
+    loop_var: initialize_user

ansible/roles/firewall/tasks/freebsd.yaml

@@ -0,0 +1,29 @@
+- name: Install service configuration
+  copy:
+    src: "files/{{ item.src }}"
+    dest: "{{ item.dest }}"
+    mode: 0644
+    owner: root
+    group: wheel
+  loop:
+    - src: rc.conf
+      dest: /etc/rc.conf.d/pf
+
+- name: Install PF configuration
+  copy:
+    src: "files/{{ item.src }}"
+    dest: "{{ item.dest }}"
+    mode: 0644
+    owner: root
+    group: wheel
+    validate: "pfctl -vnf %s"
+  notify: restart pf
+  loop:
+    - src: "{{ pf_config }}"
+      dest: /etc/pf.conf
+
+- name: Check if pf is running
+  shell: service pf status
+  register: is_pf_running
+  failed_when: is_pf_running.rc != 0
+  ignore_errors: true

ansible/roles/firewall/tasks/linux.yaml

@@ -0,0 +1,6 @@
+# - name: Install packages
+#   pacman:
+#     name:
+#       - foo
+#     state: present
+#     update_cache: true

ansible/roles/firewall/tasks/main.yaml

@@ -0,0 +1,2 @@
+- import_tasks: tasks/common.yaml
+  when: (pf_config is defined and os_flavor == "freebsd") or (os_flavor == "linux")

ansible/roles/firewall/tasks/peruser.yaml

@@ -0,0 +1,8 @@
+- include_role:
+    name: per_user
+
+- import_tasks: tasks/peruser_freebsd.yaml
+  when: 'os_flavor == "freebsd"'
+
+- import_tasks: tasks/peruser_linux.yaml
+  when: 'os_flavor == "linux"'