Consolidate nftables setup for alpine, debian and ceph roles

roles/ceph/tasks/firewall.yml

@@ -1,16 +0,0 @@
-- name: Install nftables
-  package:
-    name: nftables
-
-- name: Configure nftables
-  template:
-    dest: /etc/nftables.conf
-    src: nftables.conf.j2
-    mode: 0644
-  notify: reload nftables
-
-- name: Enable nftables
-  service:
-    name: nftables
-    enabled: true
-    state: started

roles/ceph/tasks/main.yml

@@ -3,6 +3,13 @@
     dest: /etc/hosts
     src: hosts.j2
 
+- name: Configure nftables
+  template:
+    dest: /etc/nftables.d/ceph.nft
+    src: ceph.nft.j2
+    mode: 0644
+  notify: reload nftables
+
 - name: Set up NTP servers
   lineinfile:
     path: /etc/systemd/timesyncd.conf
@@ -38,6 +45,4 @@
     dest: /usr/local/bin/cephadm
     mode: 0755
 
-- include_tasks: firewall.yml
-
 - include_tasks: cert.yml

roles/ceph/templates/ceph.nft.j2

@@ -1,7 +1,3 @@
-#!/usr/sbin/nft -f
-
-flush ruleset
-
 table inet filter {
     set cluster {
         type ipv4_addr; flags interval; auto-merge
@@ -27,25 +23,6 @@ table inet filter {
     }
 
     chain input {
-        type filter hook input priority filter; policy drop
-
-        ct state vmap { invalid : drop, established : accept, related : accept }
-        iif lo accept
-
-        ip protocol icmp icmp type {
-            echo-request, echo-reply, destination-unreachable,
-            parameter-problem, time-exceeded,
-        } accept comment "accept some ICMPv4"
-
-        ip6 nexthdr icmpv6 icmpv6 type {
-            echo-request, echo-reply, destination-unreachable,
-            packet-too-big, parameter-problem, time-exceeded,
-        } accept comment "accept some ICMPv6"
-
-        iif mgmt0 ip6 hoplimit 255 ip6 nexthdr icmpv6 icmpv6 type {
-            nd-neighbor-advert, nd-neighbor-solicit, nd-router-advert
-        } accept comment "accept IPv6 neighbor discovery"
-
         # BGP / BFD sessions
         iif lan0 ip6 saddr fe80::/64 accept
         iif lan1 ip6 saddr fe80::/64 accept
@@ -73,12 +50,4 @@ table inet filter {
 
 {% endfor %}
     }
-
-    chain forward {
-        type filter hook forward priority filter; policy accept
-    }
-
-    chain output {
-        type filter hook output priority filter; policy accept
-    }
 }