Consolidate nftables setup for alpine, debian and ceph roles

roles/debian/files/nftables.conf

@@ -0,0 +1,36 @@
+#!/usr/sbin/nft -f
+
+flush ruleset
+
+table inet filter {
+    chain input {
+        type filter hook input priority filter; policy drop
+
+        ct state vmap { invalid : drop, established : accept, related : accept }
+        iif lo accept
+
+        ip protocol icmp icmp type {
+            echo-request, echo-reply, destination-unreachable,
+            parameter-problem, time-exceeded,
+        } accept comment "accept some ICMPv4"
+
+        ip6 nexthdr icmpv6 icmpv6 type {
+            echo-request, echo-reply, destination-unreachable,
+            packet-too-big, parameter-problem, time-exceeded,
+        } accept comment "accept some ICMPv6"
+
+        ip6 hoplimit 255 ip6 nexthdr icmpv6 icmpv6 type {
+            nd-neighbor-advert, nd-neighbor-solicit, nd-router-advert, nd-router-solicit
+        } accept comment "accept IPv6 neighbor discovery"
+    }
+
+    chain forward {
+        type filter hook forward priority filter; policy drop
+    }
+
+    chain output {
+        type filter hook output priority filter; policy accept
+    }
+}
+
+include "/etc/nftables.d/*.nft"

roles/debian/handlers/main.yml

@@ -6,6 +6,12 @@
   command: ifreload -a
   when: "'handler' not in ansible_skip_tags"
 
+- name: reload nftables
+  service:
+    name: nftables
+    state: reloaded
+  when: "'handler' not in ansible_skip_tags"
+
 - name: reload sshd
   service:
     name: sshd

roles/debian/tasks/main.yml

@@ -21,6 +21,7 @@
     name:
       - git
       - ifupdown2
+      - nftables
       - rsync
       - vim
       - tmux
@@ -67,6 +68,29 @@
       value: 'prohibit-password'
   notify: reload sshd
 
+- name: Set up generic firewall rules
+  copy:
+    dest: /etc/nftables.conf
+    src: nftables.conf
+  notify: reload nftables
+
+- name: Create nftables include directory
+  file:
+    path: /etc/nftables.d
+    state: directory
+
+- name: Set up local firewall rules
+  template:
+    dest: /etc/nftables.d/services.nft
+    src: services.nft.j2
+  notify: reload nftables
+
+- name: Enable firewall
+  service:
+    name: nftables
+    enabled: yes
+    state: started
+
 - name: Run SSH instance in management VRF
   when: interfaces | selectattr('vrf') | selectattr('vrf.name', '==', 'mgmt')
   block:
@@ -90,4 +114,4 @@
         enabled: yes
       notify: reboot
 
-- meta: flush_handlers
+    - meta: flush_handlers