One of the best things about blogging is the comments you get from people around the world. I had a comment on my post about iptables where someone recommended a different idea. Well, it turns out I like his idea better. In his wiki macbarfuss demonstrates a method that uses
@includes instead of host variables.
You can read it on his page so I’ll just summarize it:
- In your base role install ferm, the main ferm conf, and a ferm.d directory to hold ferm fragments.
- Each role add its own fragments to the ferm.d directory. The main ferm conf file will include them.
Very simple. No role has to know about another and you can create very complex iptables configurations. The only down side is that you have to give up perfect idempotency. Ansible does not support this pattern (and doesn’t seem likely to in the future) but this is a worthwhile trade.
There are a couple of things I suggest you add to his instructions.
- In the base role and in the other roles remove all the notify code and handlers. You don’t need it. Its redundant.
- Add a new role (something like “iptables-end”) and add two plays (no handlers): a) run ferm, save iptables. Add this as the last role to your hosts in
- ferm will load your fragments in alphabetical order so you need to use the old Unix trick of numbering your files. For example, name your fragments “100_web_server” or “110_mysql_server”. I use a number plus the role name.
- Include an end fragment in your base role that has the highest number in your series, e.g. “999_iptables_end”. You may or may not need this. I use this fragment to send blocked packets to the log. This fragment will be loaded last.
My thanks to macbarfuss for this great idea.