diff --git a/README.md b/README.md index 5efbd088..4f90ac2f 100644 --- a/README.md +++ b/README.md @@ -155,6 +155,7 @@ ipaserver_install_packages=no ipaserver_setup_firewalld=no ``` The installation of packages and also the configuration of the firewall are by default enabled. +Note that it is not enough to mask systemd firewalld service to skip the firewalld configuration. You need to set the variable to `no`. For more server settings, please have a look at the [server role documentation](roles/ipaserver/README.md). @@ -230,6 +231,7 @@ ipareplica_setup_firewalld=no ``` The installation of packages and also the configuration of the firewall are by default enabled. +Note that it is not enough to mask systemd firewalld service to skip the firewalld configuration. You need to set the variable to `no`. For more replica settings, please have a look at the [replica role documentation](roles/ipareplica/README.md). diff --git a/roles/ipareplica/tasks/install.yml b/roles/ipareplica/tasks/install.yml index 259ae3fb..98681e06 100644 --- a/roles/ipareplica/tasks/install.yml +++ b/roles/ipareplica/tasks/install.yml @@ -20,6 +20,19 @@ state: present when: ipareplica_setup_adtrust | bool + - name: Install - Ensure that firewall packages installed + package: + name: "{{ ipareplica_packages_firewalld }}" + state: present + when: ipareplica_setup_firewalld | bool + + - name: Firewalld service - Ensure that firewalld is running + systemd: + name: firewalld + enabled: yes + state: started + when: ipareplica_setup_firewalld | bool + when: ipareplica_install_packages | bool #- name: Install - Include Python2/3 import test diff --git a/roles/ipareplica/vars/CentOS-7.yml b/roles/ipareplica/vars/CentOS-7.yml index 2baa874f..614de3e5 100644 --- a/roles/ipareplica/vars/CentOS-7.yml +++ b/roles/ipareplica/vars/CentOS-7.yml @@ -2,4 +2,5 @@ # vars/RedHat-7.yml ipareplica_packages: [ "ipa-server", "libselinux-python" ] ipareplica_packages_dns: [ "ipa-server-dns" ] -ipareplica_packages_adtrust: [ "ipa-server-trust-ad" ] \ No newline at end of file +ipareplica_packages_adtrust: [ "ipa-server-trust-ad" ] +ipareplica_packages_firewalld: [ "firewalld" ] \ No newline at end of file diff --git a/roles/ipareplica/vars/Fedora-25.yml b/roles/ipareplica/vars/Fedora-25.yml index f1dc77f6..ce981ff8 100644 --- a/roles/ipareplica/vars/Fedora-25.yml +++ b/roles/ipareplica/vars/Fedora-25.yml @@ -2,4 +2,5 @@ # vars/Fedora-25.yml ipareplica_packages: [ "ipa-server", "libselinux-python" ] ipareplica_packages_dns: [ "ipa-server-dns" ] -ipareplica_packages_adtrust: [ "ipa-server-trust-ad" ] \ No newline at end of file +ipareplica_packages_adtrust: [ "ipa-server-trust-ad" ] +ipareplica_packages_firewalld: [ "firewalld" ] \ No newline at end of file diff --git a/roles/ipareplica/vars/Fedora-26.yml b/roles/ipareplica/vars/Fedora-26.yml index a5250267..5a65e43a 100644 --- a/roles/ipareplica/vars/Fedora-26.yml +++ b/roles/ipareplica/vars/Fedora-26.yml @@ -2,4 +2,5 @@ # vars/Fedora-26.yml ipareplica_packages: [ "ipa-server", "libselinux-python" ] ipareplica_packages_dns: [ "ipa-server-dns" ] -ipareplica_packages_adtrust: [ "ipa-server-trust-ad" ] \ No newline at end of file +ipareplica_packages_adtrust: [ "ipa-server-trust-ad" ] +ipareplica_packages_firewalld: [ "firewalld" ] \ No newline at end of file diff --git a/roles/ipareplica/vars/Fedora-27.yml b/roles/ipareplica/vars/Fedora-27.yml index f4e7ffcc..5d6f02a1 100644 --- a/roles/ipareplica/vars/Fedora-27.yml +++ b/roles/ipareplica/vars/Fedora-27.yml @@ -2,4 +2,5 @@ # vars/Fedora.yml ipareplica_packages: [ "ipa-server", "libselinux-python" ] ipareplica_packages_dns: [ "ipa-server-dns" ] -ipareplica_packages_adtrust: [ "ipa-server-trust-ad" ] \ No newline at end of file +ipareplica_packages_adtrust: [ "ipa-server-trust-ad" ] +ipareplica_packages_firewalld: [ "firewalld" ] \ No newline at end of file diff --git a/roles/ipareplica/vars/Fedora.yml b/roles/ipareplica/vars/Fedora.yml index 5998d6de..f19fb996 100644 --- a/roles/ipareplica/vars/Fedora.yml +++ b/roles/ipareplica/vars/Fedora.yml @@ -2,4 +2,5 @@ # vars/Fedora.yml ipareplica_packages: [ "freeipa-server", "python3-libselinux" ] ipareplica_packages_dns: [ "freeipa-server-dns" ] -ipareplica_packages_adtrust: [ "freeipa-server-trust-ad" ] \ No newline at end of file +ipareplica_packages_adtrust: [ "freeipa-server-trust-ad" ] +ipareplica_packages_firewalld: [ "firewalld" ] \ No newline at end of file diff --git a/roles/ipareplica/vars/RedHat-7.3.yml b/roles/ipareplica/vars/RedHat-7.3.yml index f7a951bc..a0e7ffea 100644 --- a/roles/ipareplica/vars/RedHat-7.3.yml +++ b/roles/ipareplica/vars/RedHat-7.3.yml @@ -2,4 +2,5 @@ # vars/RedHat-7.3.yml ipareplica_packages: [ "ipa-server", "libselinux-python" ] ipareplica_packages_dns: [ "ipa-server-dns" ] -ipareplica_packages_adtrust: [ "ipa-server-trust-ad" ] \ No newline at end of file +ipareplica_packages_adtrust: [ "ipa-server-trust-ad" ] +ipareplica_packages_firewalld: [ "firewalld" ] \ No newline at end of file diff --git a/roles/ipareplica/vars/RedHat-7.yml b/roles/ipareplica/vars/RedHat-7.yml index 2baa874f..614de3e5 100644 --- a/roles/ipareplica/vars/RedHat-7.yml +++ b/roles/ipareplica/vars/RedHat-7.yml @@ -2,4 +2,5 @@ # vars/RedHat-7.yml ipareplica_packages: [ "ipa-server", "libselinux-python" ] ipareplica_packages_dns: [ "ipa-server-dns" ] -ipareplica_packages_adtrust: [ "ipa-server-trust-ad" ] \ No newline at end of file +ipareplica_packages_adtrust: [ "ipa-server-trust-ad" ] +ipareplica_packages_firewalld: [ "firewalld" ] \ No newline at end of file diff --git a/roles/ipareplica/vars/RedHat-8.yml b/roles/ipareplica/vars/RedHat-8.yml index 2aad358b..02573025 100644 --- a/roles/ipareplica/vars/RedHat-8.yml +++ b/roles/ipareplica/vars/RedHat-8.yml @@ -3,3 +3,4 @@ ipareplica_packages: [ "@idm:DL1/server" ] ipareplica_packages_dns: [ "@idm:DL1/dns" ] ipareplica_packages_adtrust: [ "@idm:DL1/adtrust" ] +ipareplica_packages_firewalld: [ "firewalld" ] diff --git a/roles/ipareplica/vars/Ubuntu.yml b/roles/ipareplica/vars/Ubuntu.yml index 761989a6..7cdabbfb 100644 --- a/roles/ipareplica/vars/Ubuntu.yml +++ b/roles/ipareplica/vars/Ubuntu.yml @@ -2,3 +2,4 @@ ipareplica_packages: [ "freeipa-server" ] ipareplica_packages_dns: [ "freeipa-server-dns" ] ipareplica_packages_adtrust: [ "freeipa-server-trust-ad" ] +ipareplica_packages_firewalld: [ "firewalld" ] diff --git a/roles/ipareplica/vars/default.yml b/roles/ipareplica/vars/default.yml index a1898867..ce7393a1 100644 --- a/roles/ipareplica/vars/default.yml +++ b/roles/ipareplica/vars/default.yml @@ -3,3 +3,4 @@ ipareplica_packages: [ "freeipa-server", "python3-libselinux" ] ipareplica_packages_dns: [ "freeipa-server-dns" ] ipareplica_packages_adtrust: [ "freeipa-server-trust-ad" ] +ipareplica_packages_firewalld: [ "firewalld" ] diff --git a/roles/ipaserver/tasks/install.yml b/roles/ipaserver/tasks/install.yml index 268f5d36..85df9a7d 100644 --- a/roles/ipaserver/tasks/install.yml +++ b/roles/ipaserver/tasks/install.yml @@ -19,6 +19,19 @@ state: present when: ipaserver_setup_adtrust | bool + - name: Install - Ensure that firewall packages installed + package: + name: "{{ ipaserver_packages_firewalld }}" + state: present + when: ipaserver_setup_firewalld | bool + + - name: Firewalld service - Ensure that firewalld is running + systemd: + name: firewalld + enabled: yes + state: started + when: ipaserver_setup_firewalld | bool + when: ipaserver_install_packages | bool #- name: Install - Include Python2/3 import test diff --git a/roles/ipaserver/vars/CentOS-7.yml b/roles/ipaserver/vars/CentOS-7.yml index 079b719c..11863757 100644 --- a/roles/ipaserver/vars/CentOS-7.yml +++ b/roles/ipaserver/vars/CentOS-7.yml @@ -2,4 +2,5 @@ # vars/rhel.yml ipaserver_packages: [ "ipa-server", "libselinux-python" ] ipaserver_packages_dns: [ "ipa-server-dns" ] -ipaserver_packages_adtrust: [ "ipa-server-trust-ad" ] \ No newline at end of file +ipaserver_packages_adtrust: [ "ipa-server-trust-ad" ] +ipaserver_packages_firewalld: [ "firewalld" ] \ No newline at end of file diff --git a/roles/ipaserver/vars/Fedora-25.yml b/roles/ipaserver/vars/Fedora-25.yml index d97afb19..374056c0 100644 --- a/roles/ipaserver/vars/Fedora-25.yml +++ b/roles/ipaserver/vars/Fedora-25.yml @@ -1,3 +1,4 @@ ipaserver_packages: [ "ipa-server", "libselinux-python" ] ipaserver_packages_dns: [ "ipa-server-dns" ] -ipaserver_packages_adtrust: [ "ipa-server-trust-ad" ] \ No newline at end of file +ipaserver_packages_adtrust: [ "ipa-server-trust-ad" ] +ipaserver_packages_firewalld: [ "firewalld" ] \ No newline at end of file diff --git a/roles/ipaserver/vars/Fedora-26.yml b/roles/ipaserver/vars/Fedora-26.yml index d97afb19..374056c0 100644 --- a/roles/ipaserver/vars/Fedora-26.yml +++ b/roles/ipaserver/vars/Fedora-26.yml @@ -1,3 +1,4 @@ ipaserver_packages: [ "ipa-server", "libselinux-python" ] ipaserver_packages_dns: [ "ipa-server-dns" ] -ipaserver_packages_adtrust: [ "ipa-server-trust-ad" ] \ No newline at end of file +ipaserver_packages_adtrust: [ "ipa-server-trust-ad" ] +ipaserver_packages_firewalld: [ "firewalld" ] \ No newline at end of file diff --git a/roles/ipaserver/vars/Fedora-27.yml b/roles/ipaserver/vars/Fedora-27.yml index fa21e34c..b8bfb577 100644 --- a/roles/ipaserver/vars/Fedora-27.yml +++ b/roles/ipaserver/vars/Fedora-27.yml @@ -1,3 +1,4 @@ ipaserver_packages: [ "ipa-server", "libselinux-python" ] ipaserver_packages_dns: [ "ipa-server-dns" ] ipaserver_packages_adtrust: [ "ipa-server-trust-ad" ] +ipaserver_packages_firewalld: [ "firewalld" ] diff --git a/roles/ipaserver/vars/Fedora.yml b/roles/ipaserver/vars/Fedora.yml index 9db4446a..55a38382 100644 --- a/roles/ipaserver/vars/Fedora.yml +++ b/roles/ipaserver/vars/Fedora.yml @@ -1,3 +1,4 @@ ipaserver_packages: [ "freeipa-server", "python3-libselinux" ] ipaserver_packages_dns: [ "freeipa-server-dns" ] -ipaserver_packages_adtrust: [ "freeipa-server-trust-ad" ] \ No newline at end of file +ipaserver_packages_adtrust: [ "freeipa-server-trust-ad" ] +ipaserver_packages_firewalld: [ "firewalld" ] \ No newline at end of file diff --git a/roles/ipaserver/vars/RedHat-7.3.yml b/roles/ipaserver/vars/RedHat-7.3.yml index 079b719c..11863757 100644 --- a/roles/ipaserver/vars/RedHat-7.3.yml +++ b/roles/ipaserver/vars/RedHat-7.3.yml @@ -2,4 +2,5 @@ # vars/rhel.yml ipaserver_packages: [ "ipa-server", "libselinux-python" ] ipaserver_packages_dns: [ "ipa-server-dns" ] -ipaserver_packages_adtrust: [ "ipa-server-trust-ad" ] \ No newline at end of file +ipaserver_packages_adtrust: [ "ipa-server-trust-ad" ] +ipaserver_packages_firewalld: [ "firewalld" ] \ No newline at end of file diff --git a/roles/ipaserver/vars/RedHat-7.yml b/roles/ipaserver/vars/RedHat-7.yml index 079b719c..11863757 100644 --- a/roles/ipaserver/vars/RedHat-7.yml +++ b/roles/ipaserver/vars/RedHat-7.yml @@ -2,4 +2,5 @@ # vars/rhel.yml ipaserver_packages: [ "ipa-server", "libselinux-python" ] ipaserver_packages_dns: [ "ipa-server-dns" ] -ipaserver_packages_adtrust: [ "ipa-server-trust-ad" ] \ No newline at end of file +ipaserver_packages_adtrust: [ "ipa-server-trust-ad" ] +ipaserver_packages_firewalld: [ "firewalld" ] \ No newline at end of file diff --git a/roles/ipaserver/vars/RedHat-8.yml b/roles/ipaserver/vars/RedHat-8.yml index 5b9caac1..7f5ae464 100644 --- a/roles/ipaserver/vars/RedHat-8.yml +++ b/roles/ipaserver/vars/RedHat-8.yml @@ -3,3 +3,4 @@ ipaserver_packages: [ "@idm:DL1/server" ] ipaserver_packages_dns: [ "@idm:DL1/dns" ] ipaserver_packages_adtrust: [ "@idm:DL1/adtrust" ] +ipaserver_packages_firewalld: [ "firewalld" ] diff --git a/roles/ipaserver/vars/Ubuntu.yml b/roles/ipaserver/vars/Ubuntu.yml index b3944a92..d0e01ea8 100644 --- a/roles/ipaserver/vars/Ubuntu.yml +++ b/roles/ipaserver/vars/Ubuntu.yml @@ -2,3 +2,4 @@ ipaserver_packages: [ "freeipa-server" ] ipaserver_packages_dns: [ "freeipa-server-dns" ] ipaserver_packages_adtrust: [ "freeipa-server-trust-ad" ] +ipaserver_packages_firewalld: [ "firewalld" ] diff --git a/roles/ipaserver/vars/default.yml b/roles/ipaserver/vars/default.yml index eb5c4894..9f6d58a4 100644 --- a/roles/ipaserver/vars/default.yml +++ b/roles/ipaserver/vars/default.yml @@ -3,3 +3,4 @@ ipaserver_packages: [ "ipa-server", "python3-libselinux" ] ipaserver_packages_dns: [ "ipa-server-dns" ] ipaserver_packages_adtrust: [ "freeipa-server-trust-ad" ] +ipaserver_packages_firewalld: [ "firewalld" ]