ceph: set up firewall

Still need to drop the hardcoded allowed set.

roles/ceph/tasks/firewall.yml

@@ -1,3 +1,7 @@
+- name: Retrieve service list
+  set_fact:
+    services: '{{ query("netbox.netbox.nb_lookup", "clusters", raw_data=true, api_filter="name="+cluster) | map(attribute="custom_fields.services") | flatten }}'
+
 - name: Install nftables
   package:
     name: nftables

roles/ceph/templates/nftables.conf.j2

@@ -51,6 +51,21 @@ table inet filter {
         ip saddr @cluster accept comment "accept connections from other nodes"
         ip6 saddr @cluster/6 accept comment "accept connections from other nodes"
 
+{% for service in services %}
+{% set prefixes = service | allowed_prefixes %}
+{% set prefixes4 = prefixes | selectattr('family.value', '==', 4) | map('string') %}
+{% set prefixes6 = prefixes | selectattr('family.value', '==', 6) | map('string') %}
+{% set ports = service.ports | compact_numlist %}
+        # service {{ service.name }}
+{% if prefixes4 %}
+        ip saddr { {{ prefixes4 | join(', ') }} } tcp dport { {{ ports }} } accept
+{% endif %}
+{% if prefixes6 %}
+        ip6 saddr { {{ prefixes6 | join(', ') }} } tcp dport { {{ ports }} } accept
+{% endif %}
+
+{% endfor %}
+
         ip saddr @allowed accept
         ip6 saddr @allowed/6 accept
     }