0

I deploy an Ansible playbook to some debian:stable machines aiming to update package index cache, install ufw and setup it in the Ansible architecture-agnostic and version-agnostic way.

- name: Update all apt package index cache (apt update)
  apt: update_cache=yes

- name: Install a latest ufw
  apt:
    name: ufw
    state: latest

- name: Setup firewall with ufw
  ufw:
    rule: allow
    port: 22,25,80,443

My difficulty here

In Bash I also regularly use ufw --force enable but I didn't find how to add it to the playbook in Ansible-YAML syntax in Ansible ufw documentation.

My question

How should I add ufw --force enable correctly, if at all?

  • Are you suggesting that it gets installed but stays disabled? – tink Dec 14 '18 at 16:59
  • @tink Hi ! Well, no, I just want to understand why the docs doesn't mention these arguments of --force and enable. – JohnDoea Dec 14 '18 at 17:00
  • There's state = enabled/disabled... I don't think using --force is idempotent, which is the one of the idea behind using Ansible – cricket_007 Dec 16 '18 at 19:25
  • @cricket_007 AFAIK an indempotent function is a function that works but gets us nowhere. I didn't learn enough math in my youth and being hard to ensure I understand what idempotent means. Did you mean to say "given state=enabled/disabled is there, using --force is idempotent? – JohnDoea Dec 17 '18 at 1:26
  • It means that when re-ran, the state remains the same. For example, when copying files, it'll compare checksums, or deleting files, it first checks the file isn't there to begin with. By adding a force operation, you are explicitly saying "always run this action", which is somewhat against Ansible etiquette – cricket_007 Dec 17 '18 at 1:35
1
+50

If you just want to run shell commands, you use the Ansible shell or command modules.

As far as ufw goes, I think it directly edits the rules files. Looking at the source code, it's running this, before and after the actions to check if these files have changed contents.

grep '^### tuple' /lib/ufw/user.rules /lib/ufw/user6.rules /etc/ufw/user.rules /etc/ufw/user6.rules

As far as enabling, or disabling, that is what the state action is for

If you say state: enabled, it'll do ufw -f enable

    if command == 'state':
        states = {'enabled': 'enable', 'disabled': 'disable',
                  'reloaded': 'reload', 'reset': 'reset'}
        execute(cmd + [['-f'], [states[value]]])
  • Strange, man ufw doesn't even mention -f argument hence shows no evidence that -f and --force are the same. – JohnDoea Dec 18 '18 at 0:59
  • 1
    I noticed the same. I imagine they are, given that it seems to be used the same way – cricket_007 Dec 18 '18 at 1:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.