- name: Set up firewall
  template:
    dest: /etc/pve/firewall/cluster.fw
    src: cluster.fw.j2
    mode: 0640
    owner: root
    group: www-data
  when: is_primary