Initialise repository structure and placeholder files. Generic functionality works i guess, need to come up with a better solution for compose templates

roles/ufw/README.md

@@ -0,0 +1,7 @@
+# ufw
+
+Applies the default firewall policy: deny incoming, allow outgoing, allow SSH,
+and open any service ports declared by host or application variables.
+
+Tags: `ufw`, `firewall`.
+

roles/ufw/defaults/main.yml

@@ -0,0 +1,6 @@
+---
+ufw_default_incoming_policy: deny
+ufw_default_outgoing_policy: allow
+ufw_tcp_ports: "{{ ufw_allowed_tcp_ports }}"
+ufw_udp_ports: "{{ ufw_allowed_udp_ports }}"
+

roles/ufw/files/.gitkeep

@@ -0,0 +1 @@
+

roles/ufw/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: reload ufw
+  community.general.ufw:
+    state: reloaded
+

roles/ufw/tasks/main.yml

@@ -0,0 +1,40 @@
+---
+- name: Install UFW
+  ansible.builtin.apt:
+    name: ufw
+    state: present
+  tags: [ufw]
+
+- name: Set incoming policy
+  community.general.ufw:
+    direction: incoming
+    policy: "{{ ufw_default_incoming_policy }}"
+  tags: [ufw, firewall]
+
+- name: Set outgoing policy
+  community.general.ufw:
+    direction: outgoing
+    policy: "{{ ufw_default_outgoing_policy }}"
+  tags: [ufw, firewall]
+
+- name: Allow TCP ports
+  community.general.ufw:
+    rule: allow
+    port: "{{ item }}"
+    proto: tcp
+  loop: "{{ ufw_tcp_ports }}"
+  tags: [ufw, firewall]
+
+- name: Allow UDP ports
+  community.general.ufw:
+    rule: allow
+    port: "{{ item }}"
+    proto: udp
+  loop: "{{ ufw_udp_ports }}"
+  tags: [ufw, firewall]
+
+- name: Enable UFW
+  community.general.ufw:
+    state: enabled
+  tags: [ufw, firewall]
+

roles/ufw/templates/.gitkeep

@@ -0,0 +1 @@
+