Replace the nftables role with host_firewall, one atomic inet host input table with zones, geo sets and lockout rollback

host_firewall/templates/nft-host-geo.j2

@@ -0,0 +1,46 @@
+#!/bin/sh
+# {{ ansible_managed }}
+# Rebuilds the geo sets of table inet host from ipdeny. Any failed download or
+# check exits before the swap, so the previous file stays in place.
+set -eu
+
+out=/etc/nftables.d/host-geo.nft
+countries="{{ firewall.geo_countries | join(' ') }}"
+prefix='^[0-9a-f.:]+/[0-9]+$'
+
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+
+fetch() {
+	curl -fsS --retry 3 --max-time 120 -o "$2" "$1"
+	grep -Eq "$prefix" "$2" || { echo "no prefixes in $1" >&2; exit 1; }
+}
+
+for cc in $countries; do
+	fetch "https://www.ipdeny.com/ipblocks/data/aggregated/$cc-aggregated.zone" "$tmp/$cc.v4"
+	fetch "https://www.ipdeny.com/ipv6/ipaddresses/aggregated/$cc-aggregated.zone" "$tmp/$cc.v6"
+done
+
+elements() {
+	cat "$@" | grep -E "$prefix" | sed 's/$/,/'
+}
+
+{
+	echo "# Generated by $0, do not edit."
+	echo 'table inet host {'
+	echo '	set geo_v4 { type ipv4_addr; flags interval; auto-merge; elements = {'
+	elements "$tmp"/*.v4
+	echo '	} }'
+	echo '	set geo_v6 { type ipv6_addr; flags interval; auto-merge; elements = {'
+	elements "$tmp"/*.v6
+	echo '	} }'
+	echo '}'
+} >"$tmp/host-geo.nft"
+
+nft -c -f "$tmp/host-geo.nft"
+install -m 0644 "$tmp/host-geo.nft" "$out.new"
+mv -f "$out.new" "$out"
+
+if systemctl -q is-active nft-host.service; then
+	systemctl reload nft-host.service
+fi