---
# Policy-preserving extraction from configure_pfsense_initial.yml. Do not change rule values without separate approval.
- name: Check current bell state
  ansible.builtin.raw: sysctl -n hw.syscons.bell
  register: bell_state
  changed_when: false
- name: Disable startup/shutdown beep
  ansible.builtin.raw: sysctl hw.syscons.bell=0
  when: bell_state.stdout.strip() == "1"
  changed_when: true
- name: Create alias bf_wan_extern
  pfsensible.core.pfsense_alias:
    name: bf_wan_extern
    descr: bitformer WAN IP Adressen
    address: 217.13.70.132 87.138.207.238 80.152.155.27 217.13.174.202
    type: host
    state: present
- name: Create alias bf_wartung
  pfsensible.core.pfsense_alias:
    name: bf_wartung
    descr: bitformer Wartungs-IP
    address: 10.240.0.1
    type: host
    state: present
- name: Create alias rfc_1918_5735
  pfsensible.core.pfsense_alias:
    name: rfc_1918_5735
    descr: RFC1918, RFC5735 (private IPs)
    address: 10.0.0.0/8 169.254.0.0/16 172.16.0.0/12 192.168.0.0/16
    type: network
    state: present
- name: 'Add NAT outbound traffic rule (Port: 500)'
  pfsensible.core.pfsense_nat_outbound:
    descr: 'Outbound NAT for private IP space (Port: 500)'
    interface: wan
    address: null
    source: rfc_1918_5735
    destination: any:500
    staticnatport: true
    state: present
- name: Add NAT outbound traffic rule
  pfsensible.core.pfsense_nat_outbound:
    descr: Outbound NAT for private IP space
    interface: wan
    address: null
    source: rfc_1918_5735
    destination: any
    state: present
- name: 'Add firewall rule: Allow Ping'
  pfsensible.core.pfsense_rule:
    name: Allow Ping
    action: pass
    interface: wan
    ipprotocol: inet
    protocol: icmp
    icmptype: echoreq
    source: any
    destination: IP:wan
    log: true
    state: present
- name: 'Add firewall rule: Allow Webinterface access'
  pfsensible.core.pfsense_rule:
    name: bitformer Webinterface access rule
    action: pass
    interface: wan
    ipprotocol: inet
    protocol: tcp
    destination_port: 443
    source: bf_wan_extern
    destination: IP:wan
    log: true
    state: present
- name: Create Anti-Lockout ports alias
  pfsensible.core.pfsense_alias:
    name: anti_lockout_ports
    type: port
    address: 22 80 443
    descr: Ports for Anti-Lockout access
- name: Add custom Anti-Lockout Rule
  pfsensible.core.pfsense_rule:
    name: Custom Anti-Lockout Rule
    action: pass
    interface: wan
    ipprotocol: inet
    protocol: tcp
    destination_port: anti_lockout_ports
    source: any
    destination: IP:wan
    log: true
    state: present
- name: Add bitconnect VPN CA 2021
  pfsensible.core.pfsense_ca:
    name: bitconnect VPN CA 2021
    certificate: |
      -----BEGIN CERTIFICATE-----
      MIIFbDCCA1SgAwIBAgIUWV573JfAztSareWb4jnkNIdlEt8wDQYJKoZIhvcNAQEL
      BQAwITEfMB0GA1UEAwwWYml0Y29ubmVjdCBWUE4gQ0EgMjAyMTAeFw0yMTEwMDgx
      NjA1MzNaFw0zMTEwMDYxNjA1MzNaMCExHzAdBgNVBAMMFmJpdGNvbm5lY3QgVlBO
      IENBIDIwMjEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDjjoWk81zG
      vmdKCICW27cnQV6kmDwwXezC7cdmk8nVKnlcJAnVPExYV1M1wa9OYDgjb+Jc7vEV
      UKKc7h/JtWt5OSg7aLq5eh6ZZminYG+lrKC7CFhyPnKuLPW4D6ye6iTVpwlhMMbv
      fCiinuA2shniQtX21QYc8jxKdJnmfgv7/JJ0BxnWCyE8yn1xy6DyjPH9ystzKFGO
      C3HH2wH2+sgKuiyk+8yxEF3hktMIDZ/D1gTyw8wsL4PgOs78EBSf0UKjAaBBjem8
      rICxBo4yh7YvVJ+MMLc+2IMcyM3wpYPbMpA/0hXoWsAeYEOvrZR+MYQ08cQw8QEk
      MHetIjbksd9D1OSdMfghr+A+dxVpQWTOnUnG48L84E/6RD0STyz/uJjNDJ5Qn4uV
      8e6ELHbbPiWVQWw+kg8tVetH6+WELXf/7pUnV9uYr7DvijEROP6l1IX/r92qC270
      /QFiadYX0lroqaWdwk5z7DFnVVcCHqchygS97exzDg68LkSJ5pOZ6spIr9WfaGxD
      3dva4ekC/HEZUdau+NnBPnOCLD6EqOnh3RAJosgX6/eb5LHhk5agruM+1PZcWPiL
      5D0HvNjKOCGXW2yVd1fAdOy0onP4OQHK3gJPNFJ9m/LXnn5+CHvYct+3qDlxZcCR
      qH9QBE7kC/8pRmHZqC1g0rn8yiQ012eCpwIDAQABo4GbMIGYMB0GA1UdDgQWBBQ4
      pYw9Df2Ln2pUE/xRDjhebugWpTBcBgNVHSMEVTBTgBQ4pYw9Df2Ln2pUE/xRDjhe
      bugWpaElpCMwITEfMB0GA1UEAwwWYml0Y29ubmVjdCBWUE4gQ0EgMjAyMYIUWV57
      3JfAztSareWb4jnkNIdlEt8wDAYDVR0TBAUwAwEB/zALBgNVHQ8EBAMCAQYwDQYJ
      KoZIhvcNAQELBQADggIBAN1OOdv5rDgtBhYnmnId4iifvjzKQEQF5go4cJDueUo4
      86u6xJrv83sC53FKxaAcNZUxJEcFFBHKlCUTNADsKDdQxIPA2Ow6goIx914VbFO/
      OmkFWS+53o4V8zRrwTxJi3Ps0R3sgp3pok5fQNL30tMZIf1Ug05jOqSCT8GBzIS8
      wwSw6aNi/Zcs9sBuaEEap47faTowk53EJykUd8htzH/3E5ioi3hE8TsZYPKb4Frk
      mMqRbX6N78fZ0xOIewh58S4eeGlRCGlRs45ciVxuryTaloFfDDBFFBR3V4q4Y/y9
      dvjiRmDs4fod1ZGEFUfVyDPXjzWCUUQiMHxUoh9s06i5zO3YCB/mkh+11ohyE109
      ciN495vhpTONQ8GzXLc87GjVUow7btn3lfaMf1sTfLhAueHNNbDHTnhRFkUtrdCx
      73+MYpiSlLpBxnyLkTM4umYXeYNN5Od0UjYZZqlLK9MNZrM5CwVxjRxJjgV6Nbap
      4Apnfqi+d3Ulnc6Zk8w0tiVcRfrLR6EVA3JEHqFQLuXbU1+K8C0N9YNFHy2iGAxF
      Ysx7aJVvmzyoiB06/qQrHcjeizVJaqR7w6+1cuTKo+fdvp2KtyK8+pFtQt4n+unw
      3eLC1NdcEyWBtlKqG6sjSXCBCgc1z2wAOfR+sQsH64uVHqxND4rPo8X4uo28Jgv9
      -----END CERTIFICATE-----
    state: present
- name: Add bitconnect VPN-Client
  pfsensible.core.pfsense_openvpn_client:
    name: bitformer Wartungs-VPN
    ca: bitconnect VPN CA 2021
    cert: bf-customers-vpn01
    create_gw: both
    data_ciphers:
      - AES-256-GCM
      - AES-256-CBC
      - AES-128-GCM
      - CHACHA20-POLY1305
    data_ciphers_fallback: AES-256-CBC
    dev_mode: tun
    digest: SHA384
    interface: any
    mode: p2p_tls
    protocol: UDP4
    server_addr: vpngw01.bitformer.net
    server_port: 42030
    state: present
- name: Print left over manual settings to configure
  ansible.builtin.debug:
    msg:
      - 'Manuelle Einstellungen müssen vorgenommen werden:'
      - 'Firewall Max Table Entries: 500000'
      - Disable startup/shutdown beep
      - Password protect the console