roles/nftables: Basic nftables configuration

The *nftables* role handles installation and basic configuration of the
userspace components for nftables.

Note that this role currently only works on Fedora, and requires
*nftables* 0.8 or later for wildcard includes.

roles/nftables/files/nftables.conf

@@ -0,0 +1,6 @@
+#
+# This this will contain your nftables rules and
+# is read by the systemd service when restarting
+#
+
+include "/etc/nftables/ruleset.d/*.nft"

roles/nftables/handlers/main.yml

@@ -0,0 +1,4 @@
+- name: reload nftables
+  service:
+    name=nftables
+    state=reloaded

roles/nftables/tasks/main.yml

@@ -0,0 +1,29 @@
+- name: ensure nftables is installed
+  dnf:
+    name: nftables >= 0.8
+    state: present
+    enablerepo: updates-testing
+  tags:
+  - install
+
+- name: ensure nftables ruleset drop-in directory exists
+  file:
+    path=/etc/nftables/ruleset.d
+    mode=0755
+    state=directory
+- name: ensure nftables is configured
+  copy:
+    src=nftables.conf
+    dest=/etc/sysconfig/nftables.conf
+    mode=0644
+  notify: reload nftables
+
+- name: ensure nftables starts at boot
+  service:
+    name=nftables
+    enabled=yes
+- meta: flush_handlers
+- name: ensure nftables is running
+  service:
+    name=nftables
+    state=started