3a61e7de16
``` [213] SaltStack recommends using cmd.run together with onchanges, rather than cmd.wait firewalld/init.sls:53 cmd.wait: ``` Usually fix: * `cmd.wait` + `watch` To: * `cmd.run` + `onchanges` But this code doesn't use that construction, so leaving as-is.
66 lines
1.4 KiB
Plaintext
66 lines
1.4 KiB
Plaintext
|
|
# == State: firewalld
|
|
#
|
|
# This state installs/runs firewalld.
|
|
#
|
|
{% from "firewalld/map.jinja" import firewalld with context %}
|
|
|
|
{% if salt['grains.get']('osfullname') == "SLES" and salt['grains.get']('osmajorrelease')|int < 15 %}
|
|
|
|
firewalld-unsupported:
|
|
test.show_notification:
|
|
- text: |
|
|
Firewalld is not supported on {{ grains['os'] }}
|
|
See https://www.suse.com/releasenotes/x86_64/SUSE-SLES/15/#fate-323460
|
|
|
|
{% elif firewalld.enabled %}
|
|
|
|
include:
|
|
{% if grains.get('osfinger', '') == 'Debian-10' %}
|
|
- firewalld.debian10
|
|
{% endif %}
|
|
- firewalld.config
|
|
- firewalld.ipsets
|
|
- firewalld.backend
|
|
- firewalld.services
|
|
- firewalld.zones
|
|
- firewalld.direct
|
|
|
|
# iptables service that comes with rhel/centos
|
|
iptables:
|
|
service.disabled:
|
|
- enable: False
|
|
|
|
ip6tables:
|
|
service.disabled:
|
|
- enable: False
|
|
|
|
package_firewalld:
|
|
pkg.installed:
|
|
- name: {{ firewalld.package }}
|
|
|
|
service_firewalld:
|
|
service.running:
|
|
- name: {{ firewalld.service }}
|
|
- enable: True # start on boot
|
|
- require:
|
|
- pkg: package_firewalld
|
|
- file: config_firewalld
|
|
- service: iptables # ensure it's stopped
|
|
- service: ip6tables # ensure it's stopped
|
|
|
|
reload_firewalld:
|
|
cmd.wait: # noqa: 213
|
|
- name: 'firewall-cmd --reload'
|
|
- require:
|
|
- service: service_firewalld
|
|
|
|
{% else %}
|
|
|
|
service_firewalld:
|
|
service.dead:
|
|
- name: {{ firewalld.service }}
|
|
- enable: False # don't start on boot
|
|
|
|
{% endif %}
|