Network

- name: Declarative Network Configuration (File-Based)
  hosts: all
  become: true
  gather_facts: true

  tasks:
    - name: 1. Network | Copy Netplan configuration file from template
      ansible.builtin.template:
        src: netplan.yaml.j2
        dest: /etc/netplan/01-netcfg.yaml
        mode: '0600'
      notify: Apply netplan

    - name: 2. Firewall | Copy UFW/NFTables rules file
      ansible.builtin.copy:
        src: files/rules.v4
        dest: /etc/iptables/rules.v4
        mode: '0644'
      notify: Reload iptables

    - name: 3. Docker | Copy Docker Compose file for microservices
      ansible.builtin.template:
        src: docker-compose.yml.j2
        dest: /opt/app/docker-compose.yml
        mode: '0644'
      notify: Restart docker compose

  handlers:
    - name: Apply netplan
      ansible.builtin.command: netplan apply

    - name: Reload iptables
      ansible.builtin.command: iptables-restore < /etc/iptables/rules.v4

    - name: Restart docker compose
      ansible.builtin.command: docker compose -f /opt/app/docker-compose.yml up -d --remove-orphans

- name: Imperative Network Configuration (API and Command-Based)
  hosts: all
  become: true
  gather_facts: true

  tasks:
    - name: 1. Network | Set IP address via NMCLI tool immediately
      community.general.nmcli:
        conn_name: "{{ ansible_default_ipv4.interface }}"
        ifname: "{{ ansible_default_ipv4.interface }}"
        type: ethernet
        ip4: "192.168.1.50/24"
        gw4: "192.168.1.1"
        state: present

    - name: 2. Firewall | Add rules directly into Linux Kernel table
      ansible.builtin.iptables:
        chain: INPUT
        protocol: tcp
        destination_port: "{{ item }}"
        jump: ACCEPT
      loop: ['22', '80', '443']

    - name: 3. Docker | Request Docker Engine API to create network bridge
      community.docker.docker_network:
        name: proxy_network
        driver: bridge
        ipam_config:
          - subnet: "172.30.0.0/16"

    - name: 4. Docker | Request Docker Engine API to run container
      community.docker.docker_container:
        name: web_server
        image: nginx:alpine
        networks:
          - name: proxy_network
        ports:
          - "80:80"