- name: Allow in required devices
  become: true
  community.general.ufw:
    rule: allow
    direction: in
    interface: "{{ item }}"
    comment: ansible managed
  with_items:
    - "{{ microk8s_net_devices }}"
  retries: 5
  delay: 10

- name: Allow out required devices
  become: true
  community.general.ufw:
    rule: allow
    direction: out
    interface: "{{ item }}"
    comment: ansible managed
  with_items:
    - "{{ microk8s_net_devices }}"
  retries: 5
  delay: 10

- name: Allow incoming specific ports
  become: true
  community.general.ufw:
    rule: "{{ item.rule }}"
    src: "{{ item.from | d('any') }}"
    port: "{{ item.port | int }}"
    proto: "{{ item.proto }}"
    comment: ansible managed
  with_items:
    - "{{ microk8s_incoming_traffic }}"
  retries: 5
  delay: 10

- name: Allow outgoing specified ports
  become: true
  community.general.ufw:
    rule: allow
    port: "{{ item | int }}"
    direction: out
    comment: ansible managed
  with_items:
    - "{{ microk8s_outgoing_traffic }}"
  retries: 5
  delay: 10

- name: Allow hosts to access the API
  become: true
  community.general.ufw:
    rule: allow
    src: "{{ item }}"
    port: 16443
    proto: tcp
    comment: ansible managed
  with_items:
    - "{{ microk8s_allowed_hosts }}"
  retries: 5
  delay: 10
