---
# Deploys the matching infra/firewall/*.rules file for this host's group and loads it. Same
# ruleset, same variables as infra/firewall/validate-firewall.sh renders locally — this task
# just uses Ansible's own templating instead of sed, against the real inventory values.

- name: Determine which ruleset applies to this host
  ansible.builtin.set_fact:
    firewall_ruleset_name: "{{ 'rn-platform-01' if inventory_hostname in groups['platform'] else 'rn-lab-host-01' }}"

- name: Render firewall ruleset for this host
  ansible.builtin.template:
    src: "{{ role_path }}/../../../firewall/{{ firewall_ruleset_name }}.rules"
    dest: /etc/iptables/rules.v4.rootnode
    owner: root
    group: root
    mode: "0600"
  notify: reload firewall

- name: Point iptables-persistent at the RootNode ruleset
  ansible.builtin.file:
    src: /etc/iptables/rules.v4.rootnode
    dest: /etc/iptables/rules.v4
    state: link
    force: true
  notify: reload firewall

- name: Flush handlers so the firewall is active before later roles assume it
  ansible.builtin.meta: flush_handlers