crowdsec_range_bouncer: enforce CrowdSec range decisions in nftables interval sets, the firewall bouncer stores only the network address of a range

crowdsec_range_bouncer/tasks/main.yml

@@ -0,0 +1,53 @@
+---
+# crowdsec-firewall-bouncer in nftables mode stores only the network address of
+# a range decision (CIDR scope "Range") in a plain address set. This role keeps
+# the ranges in interval sets of its own table, next to the firewall bouncer,
+# which keeps handling the single addresses.
+- name: Require LAPI settings
+  ansible.builtin.assert:
+    that:
+      - crowdsec.lapi_url | length > 0
+      - crowdsec.range_bouncer_api_key | default('') | length > 0
+    fail_msg: crowdsec.lapi_url and crowdsec.range_bouncer_api_key must be set
+
+- name: Install python3 and nftables
+  ansible.builtin.apt:
+    name: [python3, nftables]
+    state: present
+
+- name: Configure the range bouncer
+  ansible.builtin.template:
+    src: crowdsec-range-bouncer.json.j2
+    dest: /etc/crowdsec-range-bouncer.json
+    mode: "0600"
+  no_log: true
+  notify: Run the range bouncer
+
+- name: Install the range bouncer
+  ansible.builtin.template:
+    src: crowdsec-range-bouncer.py.j2
+    dest: /usr/local/sbin/crowdsec-range-bouncer
+    mode: "0755"
+  notify: Run the range bouncer
+
+- name: Install the systemd units
+  ansible.builtin.copy:
+    src: "{{ item }}"
+    dest: "/etc/systemd/system/{{ item }}"
+    mode: "0644"
+  loop: [crowdsec-range-bouncer.service, crowdsec-range-bouncer.timer]
+  register: crowdsec_range_bouncer_units
+  notify: Run the range bouncer
+
+- name: Enable the range bouncer timer
+  ansible.builtin.systemd:
+    name: crowdsec-range-bouncer.timer
+    enabled: true
+    state: started
+    daemon_reload: "{{ crowdsec_range_bouncer_units is changed }}"
+  # Check mode does not install the unit.
+  ignore_errors: "{{ ansible_check_mode }}"
+
+# The first run has to succeed before the play moves on to the next host.
+- name: Apply the changes now
+  ansible.builtin.meta: flush_handlers