---
#--------------------------------------------------------------#
# NODE SELinux                                    [node_selinux]
#--------------------------------------------------------------#
- name: set node selinux mode
  tags: [ node_sec, node_selinux ]
  when: node_selinux_mode|default('permissive')|lower in ['enforcing', 'permissive', 'disabled']
  ignore_errors: true
  shell: |
    MODE="{{ node_selinux_mode|default('permissive')|lower }}"
    command -v getenforce &>/dev/null || exit 0
    [ -f /etc/selinux/config ] && sed -i "s/^SELINUX=.*/SELINUX=$MODE/" /etc/selinux/config
    [ "$(getenforce 2>/dev/null)" = "Disabled" ] && exit 0
    [ "$MODE" = "enforcing" ] && setenforce 1 || setenforce 0
  args: { executable: /bin/bash }

#--------------------------------------------------------------#
# Firewall                                       [node_firewall]
#--------------------------------------------------------------#
# mode: off (disable firewall), none (do nothing), zone (trust intranet)
- name: setup node firewall
  tags: [ node_sec, node_firewall ]
  when: node_firewall_mode|default('none') != 'none'
  ignore_errors: true
  vars:
    fw_intranet: "{{ node_firewall_intranet | default([]) | join(' ') }}"
    fw_public: "{{ node_firewall_public_port | default([]) | join(' ') }}"
  shell: |
    MODE="{{ node_firewall_mode }}"
    INTRANET="{{ fw_intranet }}"
    PUBLIC="{{ fw_public }}"
    if command -v firewall-cmd &>/dev/null; then
        [[ "$MODE" == "off" ]] && { systemctl disable --now firewalld &>/dev/null; exit 0; }
        systemctl is-active firewalld &>/dev/null || systemctl enable --now firewalld &>/dev/null
        for cidr in $INTRANET; do firewall-cmd --zone=trusted --add-source=$cidr &>/dev/null; done
        for port in $PUBLIC;   do firewall-cmd --zone=public  --add-port=${port}/tcp &>/dev/null; done
        firewall-cmd --runtime-to-permanent &>/dev/null
    elif command -v ufw &>/dev/null; then
        [[ "$MODE" == "off" ]] && { ufw disable &>/dev/null; exit 0; }
        for cidr in $INTRANET; do ufw allow from $cidr &>/dev/null; done
        for port in $PUBLIC;   do ufw allow ${port}/tcp &>/dev/null; done
        ufw --force enable
    fi
    /bin/true;
  args: { executable: /bin/bash }
...
