Merge branch 'firewall'

ansible/environments/home/host_vars/homeserver

@@ -3,3 +3,7 @@ zfs_snapshot_datasets:
   - zroot/freebsd/computer/be/default
 sshd_enabled: true
 sshd_conf: "sshd_config"
+pf_config: "homeserver_pf.conf"
+pflog_conf:
+  - name: 0
+    dev: pflog0

ansible/playbook.yaml

@@ -8,3 +8,4 @@
     - zsh
     - sshd
     - base
+    - firewall

ansible/roles/firewall/defaults/main.yaml

@@ -0,0 +1 @@
+pflog_conf: []

ansible/roles/firewall/files/homeserver_pf.conf

@@ -0,0 +1,33 @@
+ext_if = "{ igb0 igb1 ix0 ix1 wlan0 }"
+
+dhcp = "{ bootpc, bootps }"
+# allow = "{ }"
+
+tcp_pass_in = "{ 22 }"
+udp_pass_in = "{ 53 51820 }"
+
+# Rules must be in order: options, normalization, queueing, translation, filtering
+
+# options
+set skip on lo
+
+# redirections
+
+# filtering
+block log all
+pass out on $ext_if
+
+# We pass on the interfaces listed in allow rather than skipping on
+# them because changes to pass rules will update when running a
+# `service pf reload` but interfaces that we `skip` will not update (I
+# forget if its from adding, removing, or both. TODO: test to figure
+# it out)
+# pass quick on $allow
+
+pass on $ext_if proto icmp all
+pass on $ext_if proto icmp6 all
+
+pass in on $ext_if proto tcp to any port $tcp_pass_in
+pass in on $ext_if proto udp to any port $udp_pass_in
+
+pass quick on $ext_if proto udp from any port $dhcp to any port $dhcp

ansible/roles/firewall/files/rc.conf

@@ -0,0 +1,2 @@
+pf_enable="YES"
+pf_rules="/etc/pf.conf"

ansible/roles/firewall/handlers/main.yaml

@@ -0,0 +1,16 @@
+- name: restart pf
+  when: is_pf_running.rc == 0
+  service:
+    name: pf
+    state: reloaded
+
+- name: restart pflog
+  when: is_pf_running.rc == 0
+  service:
+    name: pflog
+    state: restarted
+
+- name: stop pflog
+  service:
+    name: pflog
+    state: stopped

ansible/roles/firewall/tasks/common.yaml

@@ -0,0 +1,14 @@
+- import_tasks: tasks/freebsd.yaml
+  when: 'os_flavor == "freebsd"'
+
+- import_tasks: tasks/linux.yaml
+  when: 'os_flavor == "linux"'
+
+- include_tasks:
+    file: tasks/peruser.yaml
+    apply:
+      become: yes
+      become_user: "{{ initialize_user }}"
+  loop: "{{ users | dict2items | community.general.json_query('[?value.initialize==`true`].key') }}"
+  loop_control:
+    loop_var: initialize_user

ansible/roles/firewall/tasks/freebsd.yaml

@@ -0,0 +1,69 @@
+- name: Install service configuration
+  copy:
+    src: "files/{{ item.src }}"
+    dest: "{{ item.dest }}"
+    mode: 0644
+    owner: root
+    group: wheel
+  loop:
+    - src: rc.conf
+      dest: /etc/rc.conf.d/pf
+
+- name: Install PF configuration
+  copy:
+    src: "files/{{ item.src }}"
+    dest: "{{ item.dest }}"
+    mode: 0644
+    owner: root
+    group: wheel
+    validate: "pfctl -vnf %s"
+  notify: restart pf
+  loop:
+    - src: "{{ pf_config }}"
+      dest: /etc/pf.conf
+
+- name: Check if pf is running
+  shell: service pf status
+  register: is_pf_running
+  failed_when: is_pf_running.rc != 0
+  ignore_errors: true
+
+- name: Enable pflog
+  notify: restart pflog
+  community.general.sysrc:
+    name: pflog_enable
+    value: "YES"
+    path: /etc/rc.conf.d/pflog
+  when: pflog_conf|length > 0
+
+- name: Disable pflog
+  notify: stop pflog
+  community.general.sysrc:
+    name: pflog_enable
+    value: "NO"
+    path: /etc/rc.conf.d/pflog
+  when: pflog_conf|length == 0
+
+- name: Set pflog instances
+  notify: restart pflog
+  community.general.sysrc:
+    name: pflog_instances
+    value: "{{ pflog_conf|community.general.json_query('[].name')|join(' ') }}"
+    path: /etc/rc.conf.d/pflog
+  when: pflog_conf|length > 0
+
+- name: Remove pflog instances
+  notify: stop pflog
+  community.general.sysrc:
+    name: jail_list
+    state: absent
+    path: /etc/rc.conf.d/pflog
+  when: pflog_conf|length == 0
+
+- name: Set pflog device names
+  notify: restart pflog
+  community.general.sysrc:
+    name: "pflog_{{item.name}}_dev"
+    value: "{{ item.dev }}"
+    path: /etc/rc.conf.d/pflog
+  loop: "{{ pflog_conf }}"

ansible/roles/firewall/tasks/linux.yaml

@@ -0,0 +1,6 @@
+# - name: Install packages
+#   pacman:
+#     name:
+#       - foo
+#     state: present
+#     update_cache: true

ansible/roles/firewall/tasks/main.yaml

@@ -0,0 +1,2 @@
+- import_tasks: tasks/common.yaml
+  when: (pf_config is defined and os_flavor == "freebsd") or (os_flavor == "linux")

ansible/roles/firewall/tasks/peruser.yaml

@@ -0,0 +1,8 @@
+- include_role:
+    name: per_user
+
+- import_tasks: tasks/peruser_freebsd.yaml
+  when: 'os_flavor == "freebsd"'
+
+- import_tasks: tasks/peruser_linux.yaml
+  when: 'os_flavor == "linux"'