From c8fa55fafde70d05515ffd1982cae5ddf9a89868 Mon Sep 17 00:00:00 2001
From: June <june@jsts.xyz>
Date: Sat, 20 Sep 2025 21:38:39 +0200
Subject: [PATCH] nftables(role): introduce role for deploying nftables

---
 inventories/chaosknoten/hosts.yaml      |  2 ++
 playbooks/deploy.yaml                   |  5 +++++
 roles/nftables/README.md                | 11 +++++++++++
 roles/nftables/handlers/main.yaml       |  5 +++++
 roles/nftables/meta/argument_specs.yaml |  6 ++++++
 roles/nftables/tasks/main.yaml          | 15 +++++++++++++++
 6 files changed, 44 insertions(+)
 create mode 100644 roles/nftables/README.md
 create mode 100644 roles/nftables/handlers/main.yaml
 create mode 100644 roles/nftables/meta/argument_specs.yaml
 create mode 100644 roles/nftables/tasks/main.yaml

diff --git a/inventories/chaosknoten/hosts.yaml b/inventories/chaosknoten/hosts.yaml
index 98af847..82eec99 100644
--- a/inventories/chaosknoten/hosts.yaml
+++ b/inventories/chaosknoten/hosts.yaml
@@ -91,6 +91,8 @@ base_config_hosts:
 systemd_networkd_hosts:
   hosts:
     router:
+nftables_hosts:
+  hosts:
 docker_compose_hosts:
   hosts:
     ccchoir:
diff --git a/playbooks/deploy.yaml b/playbooks/deploy.yaml
index 69648b2..d971cf4 100644
--- a/playbooks/deploy.yaml
+++ b/playbooks/deploy.yaml
@@ -9,6 +9,11 @@
   roles:
     - systemd_networkd
 
+- name: Ensure nftables deployment on nftables_hosts
+  hosts: nftables_hosts
+  roles:
+    - nftables
+
 - name: Ensure deployment of infrastructure authorized keys
   hosts: infrastructure_authorized_keys_hosts
   roles:
diff --git a/roles/nftables/README.md b/roles/nftables/README.md
new file mode 100644
index 0000000..81d8871
--- /dev/null
+++ b/roles/nftables/README.md
@@ -0,0 +1,11 @@
+# Role `nftables`
+
+Deploys nftables.
+
+## Support Distributions
+
+Should work on Debian-based distributions.
+
+## Required Arguments
+
+- `nftables__config`: nftables configuration to deploy.
diff --git a/roles/nftables/handlers/main.yaml b/roles/nftables/handlers/main.yaml
new file mode 100644
index 0000000..3b72c54
--- /dev/null
+++ b/roles/nftables/handlers/main.yaml
@@ -0,0 +1,5 @@
+- name: Restart nftables service
+  ansible.builtin.systemd_service:
+    name: nftables
+    state: restarted
+  become: true
diff --git a/roles/nftables/meta/argument_specs.yaml b/roles/nftables/meta/argument_specs.yaml
new file mode 100644
index 0000000..aa56223
--- /dev/null
+++ b/roles/nftables/meta/argument_specs.yaml
@@ -0,0 +1,6 @@
+argument_specs:
+  main:
+    options:
+      nftables__config:
+        type: str
+        required: true
diff --git a/roles/nftables/tasks/main.yaml b/roles/nftables/tasks/main.yaml
new file mode 100644
index 0000000..46ea18d
--- /dev/null
+++ b/roles/nftables/tasks/main.yaml
@@ -0,0 +1,15 @@
+- name: ensure nftables is installed
+  ansible.builtin.apt:
+    name: nftables
+    state: present
+  become: true
+
+- name: deploy nftables configuration
+  ansible.builtin.copy:
+    content: "{{ nftables__config }}"
+    dest: "/etc/nftables.conf"
+    mode: "0644"
+    owner: root
+    group: root
+  become: true
+  notify: Restart nftables service