#!/usr/sbin/nft -f
# Managed by Ansible — Set-OPS

flush ruleset

table inet setops_filter {
  chain input {
    type filter hook input priority 0; policy {{ nftables_baseline_input_policy }};

    iif "lo" accept comment "socle: communications locales"
    ct state established,related accept comment "socle: connexions etablies et associees"
    ct state invalid drop comment "socle: paquets invalides"

{% if nftables_baseline_allow_icmp | bool %}
    ip protocol icmp accept comment "socle: diagnostic et erreurs reseau IPv4"
    ip6 nexthdr icmpv6 accept comment "socle: diagnostic et erreurs reseau IPv6"
{% endif %}

{% if nftables_baseline_allow_ssh | bool %}
    tcp dport {{ nftables_baseline_ssh_port }} accept comment "administration: acces SSH du gabarit de repli"
{% endif %}

{% for port in nftables_baseline_extra_tcp_ports %}
    tcp dport {{ port }} accept comment "repli: port TCP supplementaire declare par l'instance"
{% endfor %}

{% for port in nftables_baseline_extra_udp_ports %}
    udp dport {{ port }} accept comment "repli: port UDP supplementaire declare par l'instance"
{% endfor %}
  }

  chain forward {
    type filter hook forward priority 0; policy {{ nftables_baseline_forward_policy }};
  }

  chain output {
    type filter hook output priority 0; policy {{ nftables_baseline_output_policy }};
  }
}