# Alliance Boréale - Rôle Common - nftables Configuration
# Date: 2025-10-31

---
- name: "📦 Install nftables"
  ansible.builtin.apt:
    name:
      - nftables
      - python3-nftables
    state: present

- name: "🔥 Deploy nftables base rules"
  ansible.builtin.template:
    src: nftables.conf.j2
    dest: /etc/nftables.conf
    owner: root
    group: root
    mode: '0644'
  notify: reload nftables

- name: "✅ Enable and start nftables"
  ansible.builtin.systemd:
    name: nftables
    state: started
    enabled: true

- name: "🚫 Ensure iptables is not running"
  ansible.builtin.systemd:
    name: "{{ item }}"
    state: stopped
    enabled: false
  loop:
    - iptables
    - ip6tables
  failed_when: false