exam-laptop/playbook.yml

---
- name: ensure safe environment for exams
  hosts: localhost

# to verify ufw configuration run:
# sudo ufw status verbose
  tasks:
    - name: Install ufw
      apt: package=ufw state=present

    - name: Configure ufw defaults
      ufw: direction={{ item.direction }} policy={{ item.policy }}
      with_items:
        - { direction: 'incoming', policy: 'deny' }
        - { direction: 'outgoing', policy: 'deny' }

    # disable ipv6
    - lineinfile:
        path: /etc/default/ufw
        state: present
        regexp: '^IPV6'
        line: 'IPV6=no'

    - name: Enable ufw logging
      ufw: logging=off

    - name: Commenting a line.
      replace:
        path: /etc/ufw/before.rules
        regexp: '(.*limit --limit*)'
        replace: '#\1'

    - name: Allow all access to tcp port 123
      ufw:
        rule: allow
        port: '123'
        direction: '{{ item }}'
      with_items:
        - in
        - out

    - name: Allow SSH-Access to some servers
      ufw:
        rule: allow
        direction: '{{ item.direction }}'
        dest: '{{ item.destination }}'
        port: '22'
      with_items:
        - { direction: 'in',  destination: '10.0.0.1/32' }
        - { direction: 'out', destination: '10.0.0.1/32' }
        - { direction: 'in',  destination: '10.16.109.252/32' }
        - { direction: 'out', destination: '10.16.109.252/32' }
        - { direction: 'in',  destination: '10.16.1.1/32' }
        - { direction: 'out', destination: '10.16.1.1/32' }
        - { direction: 'in',  destination: '162.55.5.40/32' }
        - { direction: 'out', destination: '162.55.5.40/32' }
    - name: Allow https-Access to some servers
      ufw:
        rule: allow
        direction: '{{ item.direction }}'
        dest: '{{ item.destination }}'
        port: '443'
      with_items:
        - { direction: 'in',  destination: '10.0.0.1/32' }
        - { direction: 'out', destination: '10.0.0.1/32' }
        - { direction: 'in',  destination: '10.16.109.252/32' }
        - { direction: 'out', destination: '10.16.109.252/32' }
        - { direction: 'in',  destination: '10.16.1.1/32' }
        - { direction: 'out', destination: '10.16.1.1/32' }
        - { direction: 'in',  destination: '162.55.5.40/32' }
        - { direction: 'out', destination: '162.55.5.40/32' }

    - name: Allow DNS-Access to some servers
      ufw:
        rule: allow
        direction: '{{ item.direction }}'
        dest: '{{ item.destination }}'
        port: '53'
      with_items:
        - { direction: 'in',  destination: '10.0.0.1/32' }
        - { direction: 'out', destination: '10.0.0.1/32' }
        - { direction: 'in',  destination: '10.16.1.1/32' }
        - { direction: 'out', destination: '10.16.1.1/32' }

    - name: Allow dns
      ufw: rule={{ item.rule }} port={{ item.port }}
      with_items:
        - { rule: 'allow', port: '53'}


    - name: purge some prior installed packages
      apt: 
        name: 
          - task-kde-desktop
          - task-german-kde-desktop
          - task-german-desktop
          - xdg-desktop-portal-kde
          - xdg-desktop-portal-wlr # share screen in browser
          - kde-full
          - akonadi-backend-sqlite
          - thunderbird-l10n-de
          - webext-privacy-badger
          - webext-ublock-origin-firefox
          - webext-ublock-origin-chromium
          - vlc
          - gimp
          - inkscape
          - flameshot
          - bluefish
          - nmap
          - net-tools
          - ghex
          - thonny
          - spyder
          - mu-editor
          - dia
          - vym
          - tree
          - sqlite3
          - kicad
          - kicad-doc-de
          - akonadi-backend-mysql
          - akonadi-contacts-data
          - akonadi-mime-data
          - akonadi-server
          - akregator
          - aspell
          - aspell-de
          - dolphin
          - firebird3.0-common
          - gimp-data
          - gwenview
          - hyphen-en-us
          - ingerman
          - ispell
          - kate
          - kcalc
          - kmail
          - knotes
          - korganizer
          - wamerican
          - dragonplayer
          - juk
        autoremove: yes
        state: absent


    - name: Enable ufw
      ufw: state=enabled

    - name: start ufw service
      service: 
        name: ufw
        state: restarted