- All right.
Well, let's create a solution.
Let's call it filtwall.yaml.
And we start with the play, Heather.
In fact, it's all about providing
some default values, right?
So the hosts, let's do this on rocky.
And I'm going to start with the variables.
So the variables, that's what it's all about.
Let's call it firewall_rules.
And in firewall_rules, I am going to define a service,
HTTPS, no for further options, and a service FTP.
And for the service FTP, I want the state to be disabled.
So that is really enough.
So this is a variable that contains a list.
And for service HTTPS, we just have HTTPS.
For FTP we have the state disabled.
After all, we want to work with default values.
Now what this is about, this is all about default filter.
And let me show you.
So we are going to do a tasks name,
enable firewalld services,
and firewalld obviously is a model that we are going to use.
And then we are going to use a service.
I think it's a good idea to start with the loop.
So I want a loop,
and in this loop I am going to use firewall_rules.
Oh, there's a typo.
I want to put a conditional as well,
when item.service is defined.
So we want to do something if the service is defined.
Now, what exactly are we going to do in there?
Well, we are going to set the service to item.service.
So item.service refers to the HTTPS and the FTP.
Then we are going to set the zone.
So what are we going to do with the zone?
Well, item.zone, we use a default filter
with the default filter argument omit.
That is nice about default filter.
You can specify omit if you just wanna skip it,
if it doesn't exist.
And you can specify any text string to set that
as an argument.
So here I'm using permanent yes.
That makes sense, of course, in state.
We set state to item.state, again, with default enabled.
So if we do not specify anything else,
we want the default state to be enabled.
Now, if you use a playbook like this,
it's also nice to use a handler,
because after adding the rules to the firewall,
you need to do something with the firewall to update it.
So let's define a handler with the name reload firewall.
So now we can define the handlers themselves.
In the handler's name, reload firewall.
You know, that handlers come pretty precise.
The notify and the name of the handler need to correspond.
Then we have the service,
and the service is going to be set to name firewalld,
and state reloaded.
There we go.
And it's time for a test run.
So ansible.playbook on filtwall.yaml
is bringing us this.
And again, ansible1 has a pseudo password.
You wanna see it working on ansible1,
let's do the pseudo password.
Apparently ansible2, at some point in this course
has been setup for casting pseudo passwords
for a longer period
which has never happened on ansible1.
That's a minor detail,
and you will learn about it in lesson nine,
in case you missed it.