109 lines
3.7 KiB
YAML
109 lines
3.7 KiB
YAML
---
|
|
# 0. サービス利用前提の構築
|
|
- name: Deploy config file for flush table
|
|
ansible.builtin.copy:
|
|
src: nftables_flush.conf
|
|
dest: /etc/nftables_flush.conf
|
|
owner: root
|
|
group: root
|
|
mode: '0750'
|
|
|
|
- name: Ensure systemd override directory exists for nftables.service
|
|
ansible.builtin.file:
|
|
path: /etc/systemd/system/nftables.service.d
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: '0755'
|
|
|
|
- name: Deploy override file for nftables.service
|
|
ansible.builtin.copy:
|
|
src: nftables.service.d/override.conf
|
|
dest: /etc/systemd/system/nftables.service.d/override.conf
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
register: nft_override
|
|
|
|
- name: Reload systemd daemon if override changed
|
|
ansible.builtin.systemd_service:
|
|
daemon_reload: true
|
|
when: nft_override.changed
|
|
|
|
# 1. 【変更前】現在の実機の ruleset を取得してローカルに保存
|
|
- name: Get live nftables ruleset before deployment
|
|
ansible.builtin.command: nft list ruleset
|
|
register: nft_ruleset_before
|
|
changed_when: false
|
|
|
|
- name: Save before ruleset to local directory
|
|
ansible.builtin.copy:
|
|
content: "{{ nft_ruleset_before.stdout }}\n"
|
|
dest: "{{ fetch_dir }}/{{ inventory_hostname }}_nftables.conf.before"
|
|
mode: '0644'
|
|
delegate_to: localhost
|
|
become: false # ローカルPC側での書き込みなのでbecomeは不要
|
|
changed_when: false
|
|
|
|
# 2. 通常のデプロイ・構文チェック・リロード処理
|
|
- name: Deploy nftables.conf to production router
|
|
ansible.builtin.template:
|
|
src: "{{ nftables_template_src }}"
|
|
dest: /etc/nftables.conf
|
|
owner: root
|
|
group: root
|
|
mode: '0750'
|
|
trim_blocks: true
|
|
lstrip_blocks: true
|
|
register: nft_config
|
|
|
|
- name: Run syntax check on the remote router
|
|
ansible.builtin.command: nft -c -f /etc/nftables.conf
|
|
changed_when: false
|
|
when: nft_config.changed # 設定変更があった場合のみ実行
|
|
|
|
- name: Reload nftables service if configuration changed
|
|
ansible.builtin.systemd_service:
|
|
name: nftables
|
|
state: reloaded
|
|
when: nft_config.changed # 設定変更があった場合のみ実行
|
|
|
|
# 3. 【変更後】新しい実機の ruleset を取得してローカルに保存
|
|
- name: Get live nftables ruleset after deployment
|
|
ansible.builtin.command: nft list ruleset
|
|
register: nft_ruleset_after
|
|
changed_when: false
|
|
when: nft_config.changed # 設定変更があった場合のみ実行
|
|
|
|
- name: Save after ruleset to local directory
|
|
ansible.builtin.copy:
|
|
content: "{{ nft_ruleset_after.stdout }}\n"
|
|
dest: "{{ fetch_dir }}/{{ inventory_hostname }}_nftables.conf.after"
|
|
mode: '0644'
|
|
delegate_to: localhost
|
|
become: false # ローカルPC側での書き込みなのでbecomeは不要
|
|
changed_when: false
|
|
when: nft_config.changed # 設定変更があった場合のみ実行
|
|
|
|
# 4. 変更結果を確認するためのコマンドを表示する
|
|
- name: Show vimdiff commands for verification
|
|
ansible.builtin.debug:
|
|
msg: |
|
|
{%- set cmds = [] -%}
|
|
{%- for host in groups['routers'] -%}
|
|
{%- if hostvars[host]['nft_config'] is defined and hostvars[host]['nft_config'].changed -%}
|
|
{%- if cmds.append('vimdiff ' ~ fetch_dir ~ '/' ~ host ~ '_nftables.conf.before ' ~ fetch_dir ~ '/' ~ host ~ '_nftables.conf.after') -%}{%- endif -%}
|
|
{%- endif -%}
|
|
{%- endfor -%}
|
|
{%- if cmds | length > 0 -%}
|
|
You can copy and paste the following commands to review the actual rule differences:
|
|
{% for cmd in cmds %}
|
|
{{ cmd }}
|
|
{% endfor %}
|
|
{%- else -%}
|
|
No changes were detected across all routers. No commands to review.
|
|
{%- endif -%}
|
|
delegate_to: localhost
|
|
become: false
|
|
run_once: true
|