- dnf: name=firewalld state=latest
  tags:
  - packages

- dnf: name=python-firewall state=latest
  tags:
  - packages

# On Pidora the firewalld unit is masked
- file:
      path: /etc/systemd/system/firewalld.service
      follow: yes
  register: firewalld_unit
  failed_when: False

- command: /usr/bin/systemctl unmask firewalld
  when: firewalld_unit.state != 'absent' and firewalld_unit.src == '/dev/null'

- service: name=firewalld
           enabled=true
           state=started

- shell: firewall-cmd --get-zones
  register: firewall_zones

- shell: firewall-cmd --get-default-zone
  register: firewall_default_zone

- shell: firewall-cmd --permanent --new-zone={{ firewalld_zone }} && firewall-cmd --reload
  when: firewalld_zone not in firewall_zones.stdout

- shell: firewall-cmd --set-default-zone={{ firewalld_zone }}
  when: firewalld_zone not in firewall_default_zone.stdout

- firewalld:
    zone: "{{ firewalld_zone }}"
    permanent: yes
    immediate: yes
    state: enabled
    service: "{{ item }}"
  with_items: "{{ enabled_services }}"

- firewalld:
    zone: "{{ firewalld_zone }}"
    permanent: yes
    immediate: yes
    state: enabled
    port: "{{ item }}"
  with_items: "{{ enabled_ports }}"

- dnf: name=firewalld state=latest
  tags:
  - packages

- dnf: name=python-firewall state=latest
  tags:
  - packages

# On Pidora the firewalld unit is masked
- file:
      path: /etc/systemd/system/firewalld.service
      follow: yes
  register: firewalld_unit
  failed_when: False

- command: /usr/bin/systemctl unmask firewalld
  when: firewalld_unit.state != 'absent' and firewalld_unit.src == '/dev/null'

- service: name=firewalld
           enabled=true
           state=started

- shell: firewall-cmd --get-zones
  register: firewall_zones

- shell: firewall-cmd --get-default-zone
  register: firewall_default_zone

- shell: firewall-cmd --permanent --new-zone={{ firewalld_zone }} && firewall-cmd --reload
  when: firewalld_zone not in firewall_zones.stdout

- firewalld:
    zone: "{{ firewalld_zone }}"
    permanent: yes
    immediate: yes
    state: enabled
    service: "{{ item }}"
  with_items: "{{ enabled_services }}"

- firewalld:
    zone: "{{ firewalld_zone }}"
    permanent: yes
    immediate: yes
    state: enabled
    port: "{{ item }}"
  with_items: "{{ enabled_ports }}"

- shell: firewall-cmd --set-default-zone={{ firewalld_zone }}
  when: firewalld_zone not in firewall_default_zone.stdout

Allow SSH through the firewall *before* activating the firewall....
Allow SSH through the firewall *before* activating the firewall....
