host_firewall: optional nf_log_all_netns sysctl so the firewall logs of LXC guests reach the host kernel log

host_firewall/defaults/main.yml

@@ -51,6 +51,9 @@ firewall:
   log:
     in_rate: "5/second burst 30 packets"
     out_rate: "6/minute burst 5 packets"
+    # Lets the kernel log the nft log statements of container network
+    # namespaces (LXC guests) into the host kernel log.
+    all_netns: false
   # Reject outbound TCP 25; the mail group turns it off.
   block_smtp_out: true
   # EU-27 plus CH, NO, GB, IS, LI (ipdeny country codes). Empty leaves the geo

host_firewall/tasks/main.yml

@@ -27,6 +27,17 @@
     state: directory
     mode: "0755"
 
+# The kernel logs nft log statements of other network namespaces (LXC guests)
+# only with this sysctl; the lines land in the host kernel log.
+- name: Log the firewalls of container network namespaces
+  ansible.posix.sysctl:
+    name: net.netfilter.nf_log_all_netns
+    value: "1"
+    sysctl_file: /etc/sysctl.d/90-nf-log-all-netns.conf
+    sysctl_set: true
+    reload: false
+  when: firewall.log.all_netns
+
 - name: Install the systemd units
   ansible.builtin.copy:
     src: "{{ item }}"