---
- name: allow ssh on default interface for vagrant management
  blockinfile:
    path: "/usr/local/pf/conf/iptables-input.conf.inc"
    block: |
      # allow SSH for vagrant management
      -A INPUT --in-interface {{ ansible_default_ipv4.interface }} --jump ACCEPT
    marker: "# {mark} ANSIBLE MANAGED BLOCK - vagrant"

- name: allow external services on management interface
  blockinfile:
    path: "/usr/local/pf/conf/iptables-input-management.conf.inc"
    block: |
      # allow MailHog (SMTP and web interface) on management interface
      -A input-management-if --protocol tcp --match tcp --dport {{ mailhog__smtp_port }} --jump ACCEPT
      -A input-management-if --protocol tcp --match tcp --dport {{ mailhog__api_port }} --jump ACCEPT

      # allow Smocker interface on management interface
      -A input-management-if --protocol tcp --match tcp --dport {{ smocker__port_config }} --jump ACCEPT

      # allow RADIUS mock ports on management interface
      -A input-management-if --protocol tcp --match tcp --dport {{ radius_mock__api_port }} --jump ACCEPT
      -A input-management-if --protocol udp --match udp --dport {{ radius_mock__radius_port }} --jump ACCEPT
    marker: "# {mark} ANSIBLE MANAGED BLOCK - mailhog"
