From e4bec3cdcea7df5fd769b285346044ed9617f78e Mon Sep 17 00:00:00 2001 From: Mark Meijerman Date: Mon, 30 Dec 2024 16:42:37 +0100 Subject: [PATCH 1/2] Add ansible lint pr workflow --- .ansible-lint | 130 +++++++++++++++++++++++++++++ .github/workflows/pull-request.yml | 12 +++ .gitignore | 1 + README.md | 16 ++++ 4 files changed, 159 insertions(+) create mode 100644 .ansible-lint create mode 100644 .github/workflows/pull-request.yml create mode 100644 .gitignore diff --git a/.ansible-lint b/.ansible-lint new file mode 100644 index 0000000..8bc7251 --- /dev/null +++ b/.ansible-lint @@ -0,0 +1,130 @@ +--- +# .ansible-lint + +profile: production # min, basic, moderate,safety, shared, production + +# Allows dumping of results in SARIF format +# sarif_file: result.sarif + +# exclude_paths included in this file are parsed relative to this file's location +# and not relative to the CWD of execution. CLI arguments passed to the --exclude +# option are parsed relative to the CWD of execution. +exclude_paths: + - .github/ + - .ansible-lint +# parseable: true +# quiet: true +# strict: true +# verbosity: 1 + +# Mock modules or roles in order to pass ansible-playbook --syntax-check +#mock_modules: +# - zuul_return +# note the foo.bar is invalid as being neither a module or a collection +# - fake_namespace.fake_collection.fake_module +# - fake_namespace.fake_collection.fake_module.fake_submodule +#mock_roles: +# - mocked_role +# - author.role_name # old standalone galaxy role +# - fake_namespace.fake_collection.fake_role # role within a collection + +# Enable checking of loop variable prefixes in roles +loop_var_prefix: "^(__|{role}_)" + +# Enforce variable names to follow pattern below, in addition to Ansible own +# requirements, like avoiding python identifiers. To disable add `var-naming` +# to skip_list. +var_naming_pattern: "^[a-z_][a-z0-9_]*$" + +use_default_rules: true +# Load custom rules from this specific folder +# rulesdir: +# - ./rule/directory/ + +# Ansible-lint is able to recognize and load skip rules stored inside +# `.ansible-lint-ignore` (or `.config/ansible-lint-ignore.txt`) files. +# To skip a rule just enter filename and tag, like "playbook.yml package-latest" +# on a new line. +# Optionally you can add comments after the tag, prefixed by "#". We discourage +# the use of skip_list below because that will hide violations from the output. +# When putting ignores inside the ignore file, they are marked as ignored, but +# still visible, making it easier to address later. +skip_list: + - risky-shell-pipe + - yaml[line-length] +# - skip_this_tag + +# Ansible-lint does not automatically load rules that have the 'opt-in' tag. +# You must enable opt-in rules by listing each rule 'id' below. +enable_list: + - args + - empty-string-compare # opt-in + - no-log-password # opt-in + - no-same-owner # opt-in + - name[prefix] # opt-in + - galaxy-version-incorrect # opt-in + # add yaml here if you want to avoid ignoring yaml checks when yamllint + # library is missing. Normally its absence just skips using that rule. + - yaml +# Report only a subset of tags and fully ignore any others +# tags: +# - jinja[spacing] + +# Ansible-lint does not fail on warnings from the rules or tags listed below +#warn_list: +# - skip_this_tag +# - experimental # experimental is included in the implicit list +# - role-name +# - yaml[document-start] # you can also use sub-rule matches + +# Some rules can transform files to fix (or make it easier to fix) identified +# errors. `ansible-lint --fix` will reformat YAML files and run these transforms. +# By default it will run all transforms (effectively `write_list: ["all"]`). +# You can disable running transforms by setting `write_list: ["none"]`. +# Or only enable a subset of rule transforms by listing rules/tags here. +# write_list: +# - all + +# Offline mode disables installation of requirements.yml and schema refreshing +offline: true + + # Define required Ansible's variables to satisfy syntax check + #extra_vars: + # foo: bar + # multiline_string_variable: | + # line1 + # line2 + # complex_variable: ":{;\t$()" + + # Uncomment to enforce action validation with tasks, usually is not + # needed as Ansible syntax check also covers it. + # skip_action_validation: false + + # List of additional kind:pattern to be added at the top of the default + # match list, first match determines the file kind. + #kinds: + # - playbook: "**/examples/*.{yml,yaml}" + # - galaxy: "**/folder/galaxy.yml" + # - tasks: "**/tasks/*.yml" + # - vars: "**/vars/*.yml" +# - meta: "**/meta/main.yml" +# - yaml: "**/*.yaml-too" + +# List of additional collections to allow in only-builtins rule. +# only_builtins_allow_collections: +# - example_ns.example_collection + +# List of additions modules to allow in only-builtins rule. +# only_builtins_allow_modules: +# - example_module + +# Allow setting custom prefix for name[prefix] rule +#task_name_prefix: "{stem} | " +# Complexity related settings + +# Limit the depth of the nested blocks: +# max_block_depth: 20 + +# Also recognize these versions of Ansible as supported: +# supported_ansible_also: +# - "2.14" diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml new file mode 100644 index 0000000..4505a53 --- /dev/null +++ b/.github/workflows/pull-request.yml @@ -0,0 +1,12 @@ +--- +name: Pull request + +on: pull_request + +jobs: + ansible-lint: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - name: Run ansible-lint + uses: ansible/ansible-lint@main diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..723ef36 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +.idea \ No newline at end of file diff --git a/README.md b/README.md index e0d195d..f0afe54 100644 --- a/README.md +++ b/README.md @@ -45,6 +45,22 @@ Example Playbook - { to_port: 80 } - { to_port: 443 } +Linting +------- +Github actions will check this role with ansible-lint. To run this locally, you will need to follow the following steps: + +```bash +brew install ansible-lint +brew install yamllint +ansible-lint +``` + +to fix the linting errors, run: + +```bash +ansible-lint --fix +``` + License ------- From cac057e6ced345833a666d95a419f00d51a53c72 Mon Sep 17 00:00:00 2001 From: Mark Meijerman Date: Mon, 30 Dec 2024 16:47:04 +0100 Subject: [PATCH 2/2] Fix issues --- defaults/main.yml | 2 -- meta/main.yml | 11 +++++----- tasks/main.yml | 55 +++++++++++++++++++++++------------------------ 3 files changed, 33 insertions(+), 35 deletions(-) diff --git a/defaults/main.yml b/defaults/main.yml index 5398cfe..99d41eb 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -2,7 +2,5 @@ ufw_rules_to_create: [] ufw_rules_to_delete: [] - ufw_default_policy: - { direction: "incoming", policy: "deny" } - diff --git a/meta/main.yml b/meta/main.yml index efd0b24..b4d8770 100644 --- a/meta/main.yml +++ b/meta/main.yml @@ -2,15 +2,16 @@ galaxy_info: author: "Jasper N. Brouwer, Ramon de la Fuente" role_name: ufw + namespace: "f500" description: "Install UWF (Uncomplicated Firewall)" company: Future500 license: LGPL-3.0 - min_ansible_version: 1.6 + min_ansible_version: "1.6" platforms: - - name: Debian - versions: - - bullseye - - bookworm + - name: Debian + versions: + - bullseye + - bookworm galaxy_tags: - system - security diff --git a/tasks/main.yml b/tasks/main.yml index 6896fda..78905cd 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -1,41 +1,40 @@ --- - -- name: install ufw - apt: +- name: Install ufw + ansible.builtin.apt: name: ufw state: present -- name: create rules - ufw: - direction: "{{ item.direction|default(omit) }}" - from_ip: "{{ item.from_ip|default(omit) }}" - from_port: "{{ item.from_port|default(omit) }}" - interface: "{{ item.interface|default(omit) }}" - proto: "{{ item.proto|default(omit) }}" - rule: "{{ item.rule|default('allow') }}" - to_ip: "{{ item.to_ip|default(omit) }}" - to_port: "{{ item.to_port|default(omit) }}" +- name: Create rules + community.general.ufw: + direction: "{{ item.direction | default(omit) }}" + from_ip: "{{ item.from_ip | default(omit) }}" + from_port: "{{ item.from_port | default(omit) }}" + interface: "{{ item.interface | default(omit) }}" + proto: "{{ item.proto | default(omit) }}" + rule: "{{ item.rule | default('allow') }}" + to_ip: "{{ item.to_ip | default(omit) }}" + to_port: "{{ item.to_port | default(omit) }}" with_items: "{{ ufw_rules_to_create }}" -- name: delete rules - ufw: - direction: "{{ item.direction|default(omit) }}" - from_ip: "{{ item.from_ip|default(omit) }}" - from_port: "{{ item.from_port|default(omit) }}" - interface: "{{ item.interface|default(omit) }}" - proto: "{{ item.proto|default(omit) }}" - rule: "{{ item.rule|default('allow') }}" - to_ip: "{{ item.to_ip|default(omit) }}" - to_port: "{{ item.to_port|default(omit) }}" - delete: yes +- name: Delete rules + community.general.ufw: + direction: "{{ item.direction | default(omit) }}" + from_ip: "{{ item.from_ip | default(omit) }}" + from_port: "{{ item.from_port | default(omit) }}" + interface: "{{ item.interface | default(omit) }}" + proto: "{{ item.proto | default(omit) }}" + rule: "{{ item.rule | default('allow') }}" + to_ip: "{{ item.to_ip | default(omit) }}" + to_port: "{{ item.to_port | default(omit) }}" + delete: true with_items: "{{ ufw_rules_to_delete }}" -- name: set default policy - ufw: +- name: Set default policy + community.general.ufw: policy: "{{ item.policy }}" direction: "{{ item.direction }}" with_items: "{{ ufw_default_policy }}" -- name: enable and start ufw - ufw: +- name: Enable and start ufw + community.general.ufw: state: enabled