---
- name: Add Prometheus firewall rules
  become: true
  community.general.ufw:
    rule: allow
    src: "{{ item.cidr }}"
    port: "{{ prometheus_fw_port | string }}"
    proto: "{{ prometheus_fw_proto }}"
    comment: "{{ item.comment | default(omit) }}"
  loop: "{{ prometheus_fw_allowed_networks }}"
  loop_control:
    label: "{{ item.cidr }} -> port {{ prometheus_fw_port }}"
  when: item.cidr is defined and item.cidr | length > 0