new files from source

Infrastrucutre as Code/Ansible/roles/bootstrap_roles/firewall_ssh/tasks/main.yml

@@ -0,0 +1,69 @@
+---
+- name: Configure firewall and SSH port
+  block:
+    - name: Fail if vmid is not defined
+      ansible.builtin.fail:
+        msg: "'vmid' must be defined to calculate dynamic SSH port"
+      when: vmid is not defined
+
+    - name: Calculate SSH port from vmid
+      ansible.builtin.set_fact:
+        ssh_port: "{{ 10000 + (vmid | int % 100) }}"
+
+    - name: Enable and start firewalld
+      ansible.builtin.service:
+        name: firewalld
+        state: started
+        enabled: true
+
+    - name: Set firewalld default zone to drop
+      ansible.posix.firewalld:
+        zone: public
+        state: enabled
+        permanent: yes
+        target: DROP
+
+    - name: Reload firewalld to apply permanent changes
+      ansible.builtin.command: firewall-cmd --reload
+
+    - name: Allow custom SSH port in firewalld
+      ansible.posix.firewalld:
+        port: "{{ ssh_port }}/tcp"
+        permanent: true
+        state: enabled
+        immediate: true
+
+    - name: Allow Endlessh port in firewalld
+      ansible.posix.firewalld:
+        port: "{{ endlessh_port }}/tcp"
+        permanent: true
+        state: enabled
+        immediate: true
+
+    - name: Ensure custom SSH port is set in sshd_config
+      ansible.builtin.lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^#?Port\s+'
+        line: "Port {{ ssh_port }}"
+        backup: yes
+        validate: "/usr/sbin/sshd -T -f %s"
+      register: sshd_config_changed
+
+    - name: Gather SELinux facts
+      ansible.builtin.setup:
+        filter: ansible_selinux
+
+    - name: Allow SSH to use custom port in SELinux
+      ansible.builtin.command: >
+        semanage port -a -t ssh_port_t -p tcp {{ ssh_port }}
+      register: semanage_result
+      failed_when: semanage_result.rc not in [0, 1]
+      changed_when: semanage_result.rc == 0
+      when: ansible_selinux.status == "enabled"
+
+    - name: Restart and enable sshd service if needed
+      ansible.builtin.service:
+        name: sshd
+        state: restarted
+        enabled: true
+      when: sshd_config_changed is changed