linuxansiblefirewalld

Validate firewalld config with ansible


I'm using ansible to configure firewalld.

The lineinfile module has a validate parameter, which I'd like to use to validate my config.

I tried this:

- name: config firewalld
  become: true
  ansible.builtin.lineinfile:
    path: /etc/firewalld/firewalld.conf
    regexp: "^#?FirewallBackend"
    line: "FirewallBackend=iptables"
    state: present
    validate: firewall-cmd --check-config         # <--------------

But I get an ansible error:

validate must contain %s: firewall-cmd --check-config

That's because it's expecting the path to the file (%s).

I consulted the docs for --check-config to find a way to specify the config file's path, but couldn't find anything.

Is there a way to do this? I could run a raw sudo firewall-cmd --check-config, but I'm hoping there's a native ansible way to do this.


Solution

  • From detail on the repo, looks like this isn't possible to do cleanly with ansible. So here's a workaround:

    - name: modify config
      become: true
        # ...
      register: result1
    
    - name: modify config
      become: true
        # ...
      register: result2
    
    - name: modify config
      become: true
        # ...
      register: result3
    
    - name: validate config
      become: true
      command: firewall-cmd --check-config              
      when: result1 is changed or result2 is changed or result3 is changed
      notify: "reload firewalld"