host_firewall: drop bruteforceblocker, vxvault and cybercrime, only firehol level1 and level2 ban

host_firewall/tasks/main.yml

@@ -183,17 +183,26 @@
         dest: /usr/local/sbin/nft-host-firehol
         mode: "0755"
 
-    # The rule set includes this file and uses all of its sets, so a missing file or set would fail the load at boot.
+    # The rule set includes this file and uses both sets, so a missing file or set would fail the load at boot.
     - name: Look for the FireHOL sets
-      ansible.builtin.command: grep -cE 'set (firehol_v4|firehol_level2_v4|bruteforceblocker_v4|malware_v4) ' /etc/nftables.d/host-firehol.nft
+      ansible.builtin.command: grep -cE 'set (firehol_v4|firehol_level2_v4) ' /etc/nftables.d/host-firehol.nft
       register: firewall_firehol_sets
       changed_when: false
       failed_when: false
       check_mode: false
 
+    # Sets of removed lists are unused by the new rule set, which nft accepts, but the deployed one still uses them:
+    # a rebuild before the new rule set is confirmed would fail its reload. The rebuild at the end of the role drops them.
+    - name: Look for sets of removed FireHOL lists
+      ansible.builtin.command: grep -cE 'set (bruteforceblocker_v4|malware_v4) ' /etc/nftables.d/host-firehol.nft
+      register: firewall_firehol_stale
+      changed_when: false
+      failed_when: false
+      check_mode: false
+
     - name: Build the FireHOL sets when missing
       ansible.builtin.command: /usr/local/sbin/nft-host-firehol
-      when: firewall_firehol_sets.stdout != '4'
+      when: firewall_firehol_sets.stdout != '2'
 
     - name: Read the FireHOL sets file
       ansible.builtin.stat:
@@ -400,3 +409,12 @@
   ansible.builtin.systemd:
     daemon_reload: true
   when: firewall_greensnow_files is changed
+
+# The sets file keeps sets of removed FireHOL lists until the rule set without them is confirmed (see above).
+- name: Drop sets of removed FireHOL lists
+  ansible.builtin.command: /usr/local/sbin/nft-host-firehol
+  when:
+    - firewall.firehol
+    - firewall_firehol_sets.stdout == '2'
+    - (firewall_firehol_stale.stdout | default('0') | int) > 0
+    - not ansible_check_mode