---

- name: Install prole svc firewall enforcement script
  ansible.builtin.template:
    src: prole-svc-iptables-allow.sh.j2
    dest: /usr/local/sbin/prole-svc-iptables-allow
    owner: root
    group: root
    mode: "0755"
  when:
    - k3s_firewall_svc_allow_enabled | default(true) | bool
    - ansible_service_mgr | default('') == 'systemd'

- name: Install prole svc firewall systemd unit
  ansible.builtin.template:
    src: prole-svc-iptables-allow.service.j2
    dest: /etc/systemd/system/prole-svc-iptables-allow.service
    owner: root
    group: root
    mode: "0644"
  register: _prole_svc_fw_unit
  when:
    - k3s_firewall_svc_allow_enabled | default(true) | bool
    - ansible_service_mgr | default('') == 'systemd'

- name: Reload systemd daemon (svc firewall unit)
  ansible.builtin.systemd:
    daemon_reload: true
  when:
    - k3s_firewall_svc_allow_enabled | default(true) | bool
    - ansible_service_mgr | default('') == 'systemd'
    - _prole_svc_fw_unit is defined
    - _prole_svc_fw_unit.changed

- name: Enable and run prole svc firewall unit
  ansible.builtin.systemd:
    name: prole-svc-iptables-allow.service
    enabled: true
    state: restarted
  when:
    - k3s_firewall_svc_allow_enabled | default(true) | bool
    - ansible_service_mgr | default('') == 'systemd'