---

- name: Reload systemd daemon
  systemd:
    daemon_reload: true

- name: Restart IPv4 Firewall
  service:
    name: ipt-firewall
    state: restarted
  notify:
    - Restart fail2ban if active
    - Restart docker if active

- name: Restart IPv6 Firewall
  service:
    name: ip6t-firewall
    state: restarted
  notify:
    - Restart fail2ban if active
    - Restart docker if active

# A firewall restart flushes the fail2ban chains; restarting fail2ban
# recreates them and re-applies the active bans. Does nothing if fail2ban
# is not installed or not running.
- name: Restart fail2ban if active
  shell: |
    if systemctl is-active --quiet fail2ban ; then
       systemctl restart fail2ban
       echo restarted
    fi
  register: fail2ban_restart
  changed_when: "'restarted' in fail2ban_restart.stdout"

# A firewall restart also flushes the DOCKER* chains and the NAT rules of
# docker; restarting docker recreates them (and restarts the containers).
# Does nothing if docker is not installed or not running.
- name: Restart docker if active
  shell: |
    if systemctl is-active --quiet docker ; then
       systemctl restart docker
       echo restarted
    fi
  register: docker_restart
  changed_when: "'restarted' in docker_restart.stdout"