---
- name: Install ufw
  ansible.builtin.apt:
    name: ufw
    state: present

- name: Set UFW default incoming policy to deny
  community.general.ufw:
    direction: incoming
    policy: deny

- name: Set UFW default outgoing policy to allow
  community.general.ufw:
    direction: outgoing
    policy: allow

- name: Allow SSH from LAN only
  community.general.ufw:
    rule: allow
    port: "{{ ufw_ssh_port }}"
    proto: tcp
    from_ip: "{{ ufw_ssh_allowed_network }}"

- name: Allow HTTP and HTTPS
  community.general.ufw:
    rule: allow
    port: "{{ item }}"
    proto: tcp
  loop: "{{ ufw_allowed_tcp_ports }}"

- name: Allow extra TCP ports
  community.general.ufw:
    rule: allow
    port: "{{ item }}"
    proto: tcp
  loop: "{{ ufw_extra_tcp_ports | default([]) }}"

- name: Allow extra TCP ports from LAN
  community.general.ufw:
    rule: allow
    port: "{{ item }}"
    proto: tcp
    from_ip: "{{ ufw_ssh_allowed_network }}"
  loop: "{{ ufw_lan_tcp_ports | default([]) }}"

- name: Allow extra UDP ports or ranges
  community.general.ufw:
    rule: allow
    port: "{{ item }}"
    proto: udp
  loop: "{{ ufw_extra_udp_ports | default([]) }}"

- name: Enable UFW
  community.general.ufw:
    state: enabled