Comment out ufw rules

roles/actual/tasks/main.yml

@@ -37,13 +37,13 @@
     dest: /etc/nginx/conf.d/actual.conf
     mode: '0644'
   notify: Restart Nginx
-- name: Allow https through firewall
+# - name: Allow https through firewall
-  become: true
+#   become: true
-  community.general.ufw:
+#   community.general.ufw:
-    rule: allow
+#     rule: allow
-    port: https
+#     port: https
-    proto: tcp
+#     proto: tcp
-  notify: Restart ufw
+#   notify: Restart ufw
 - name: Debug
   ansible.builtin.debug:
     msg: "Don't forget to manually add a DNS record for actual.kleinendorst.info pointing to: {{ ansible_facts['default_ipv4']['address'] }}."

roles/basic-intalls/tasks/main.yml

@@ -6,7 +6,8 @@
       - git
       - vim
       - dnsutils
-      - ufw
+      - rsyslog
+      # - ufw
       - podman
       - snapd
     state: present
@@ -15,50 +16,45 @@
   community.general.snap:
     name: core
     state: present
-- name: Set default policy (incoming)
+# - name: Set default policy (incoming)
-  become: true
+#   become: true
-  community.general.ufw:
+#   community.general.ufw:
-    direction: incoming
+#     direction: incoming
-    policy: deny
+#     policy: deny
-  notify: Restart ufw
+#   notify: Restart ufw
-- name: Set default policy (outgoing)
+# - name: Set default policy (outgoing)
-  become: true
+#   become: true
-  community.general.ufw:
+#   community.general.ufw:
-    direction: outgoing
+#     direction: outgoing
-    policy: allow
+#     policy: allow
-  notify: Restart ufw
+#   notify: Restart ufw
-- name: Set default policy (routed)
+# - name: Set default policy (routed)
-  become: true
+#   become: true
-  community.general.ufw:
+#   community.general.ufw:
-    direction: routed
+#     direction: routed
-    policy: allow
+#     policy: allow
-  notify: Restart ufw
+#   notify: Restart ufw
-- name: Allow forwarding in ufw
+# - name: Allow forwarding in ufw
-  become: true
+#   become: true
-  ansible.builtin.lineinfile:
+#   ansible.builtin.lineinfile:
-    path: /etc/ufw/sysctl.conf
+#     path: /etc/ufw/sysctl.conf
-    regexp: '^#net/ipv4/ip_forward=1$'
+#     regexp: '^#net/ipv4/ip_forward=1$'
-    line: 'net/ipv4/ip_forward=1'
+#     line: 'net/ipv4/ip_forward=1'
-  notify: Restart ufw
+#   notify: Restart ufw
-- name: Allow forwarding in sysctl
+# - name: Allow forwarding in sysctl
-  become: true
+#   become: true
-  ansible.builtin.lineinfile:
+#   ansible.builtin.lineinfile:
-    path: /etc/sysctl.conf
+#     path: /etc/sysctl.conf
-    regexp: '^#net\.ipv4\.ip_forward=1$'
+#     regexp: '^#net\.ipv4\.ip_forward=1$'
-    line: net.ipv4.ip_forward=1
+#     line: net.ipv4.ip_forward=1
-- name: Allow all access to ssh
+# - name: Allow all access to ssh
-  become: true
+#   become: true
-  community.general.ufw:
+#   community.general.ufw:
-    rule: allow
+#     rule: allow
-    port: ssh
+#     port: ssh
-    proto: tcp
+#     proto: tcp
-  notify: Restart ufw
+#   notify: Restart ufw
-- name: Enable ufw
+# - name: Enable ufw
-  become: true
+#   become: true
-  community.general.ufw:
+#   community.general.ufw:
-    state: enabled
+#     state: enabled
-- name: Install Snapcraft
-  become: true
-  ansible.builtin.apt:
-    name:
-    state: present

roles/pi-hole/tasks/main.yml

@@ -74,29 +74,29 @@
 - name: Debug
   ansible.builtin.debug:
     msg: "Don't forget to manually add a DNS record for pi-hole.kleinendorst.info pointing to: {{ ansible_facts['default_ipv4']['address'] }}."
-- name: Add forwarding rules for ufw
+# - name: Add forwarding rules for ufw
-  become: true
+#   become: true
-  ansible.builtin.blockinfile:
+#   ansible.builtin.blockinfile:
-    path: /etc/ufw/before.rules
+#     path: /etc/ufw/before.rules
-    insertbefore: "^\\*filter$"
+#     insertbefore: "^\\*filter$"
-    block: |
+#     block: |
-      *nat
+#       *nat
-      :PREROUTING ACCEPT [0:0]
+#       :PREROUTING ACCEPT [0:0]
-      -A PREROUTING -p tcp -i eth0 --dport 53 -j DNAT \ --to-destination 127.0.0.1:5053
+#       -A PREROUTING -p tcp -i eth0 --dport 53 -j DNAT \ --to-destination 127.0.0.1:5053
-      -A PREROUTING -p udp -i eth0 --dport 53 -j DNAT \ --to-destination 127.0.0.1:5053
+#       -A PREROUTING -p udp -i eth0 --dport 53 -j DNAT \ --to-destination 127.0.0.1:5053
-      COMMIT
+#       COMMIT
-  notify: Restart ufw
+#   notify: Restart ufw
-- name: Allow all access to port 53 (udp)
+# - name: Allow all access to port 53 (udp)
-  become: true
+#   become: true
-  community.general.ufw:
+#   community.general.ufw:
-    rule: allow
+#     rule: allow
-    port: '53'
+#     port: '53'
-    proto: udp
+#     proto: udp
-  notify: Restart ufw
+#   notify: Restart ufw
-- name: Allow all access to port 53 (tcp)
+# - name: Allow all access to port 53 (tcp)
-  become: true
+#   become: true
-  community.general.ufw:
+#   community.general.ufw:
-    rule: allow
+#     rule: allow
-    port: '53'
+#     port: '53'
-    proto: tcp
+#     proto: tcp
-  notify: Restart ufw
+#   notify: Restart ufw