Ansible config for hetzner mailserver

ansible/mailserver/roles/ufw/defaults/main.yml

@@ -0,0 +1,11 @@
+---
+ufw_default_incoming: "deny"
+ufw_default_outgoing: "allow"
+ufw_allowed_ports:
+  - { port: "{{ ssh_port | default(22) }}", proto: "tcp", comment: "SSH" }
+  - { port: "25", proto: "tcp", comment: "SMTP" }
+  - { port: "465", proto: "tcp", comment: "SMTP submissions (implicit TLS)" }
+  - { port: "587", proto: "tcp", comment: "SMTP submission (STARTTLS)" }
+  - { port: "993", proto: "tcp", comment: "IMAP (implicit TLS)" }
+  - { port: "443", proto: "tcp", comment: "HTTPS (web admin + JMAP)" }
+  - { port: "8080", proto: "tcp", comment: "HTTP (certbot + redirect)" }

ansible/mailserver/roles/ufw/tasks/main.yml

@@ -0,0 +1,27 @@
+---
+- name: Install ufw
+  ansible.builtin.apt:
+    name: ufw
+    state: present
+
+- name: Set default incoming policy
+  community.general.ufw:
+    direction: incoming
+    default: "{{ ufw_default_incoming }}"
+
+- name: Set default outgoing policy
+  community.general.ufw:
+    direction: outgoing
+    default: "{{ ufw_default_outgoing }}"
+
+- name: Allow configured ports
+  community.general.ufw:
+    rule: allow
+    port: "{{ item.port }}"
+    proto: "{{ item.proto }}"
+    comment: "{{ item.comment | default(omit) }}"
+  loop: "{{ ufw_allowed_ports }}"
+
+- name: Enable ufw
+  community.general.ufw:
+    state: enabled