---
- name: "🔍 Firewall | Resolve the fragment of '{{ FIREWALL_FRAGMENT_ROLE }}'"
  ansible.builtin.set_fact:
    firewall_fragment_src: >-
      {{ lookup('first_found',
           {
             'files': [ FIREWALL_FRAGMENT_SRC ],
             'paths': [ lookup('path_absolute', 'roles', FIREWALL_FRAGMENT_ROLE) ]
           }
         ) }}
    firewall_loaded_table: "{{ FIREWALL_TABLE }}"

- name: "🧱 Firewall | Stage the ruleset of '{{ FIREWALL_FRAGMENT_ROLE }}'"
  become: true
  ansible.builtin.template: # nocheck: stack-host-template  per-host packet filter: every host carrying the rules needs the fragment, not only the stack host
    src: "{{ firewall_fragment_src }}"
    dest: "{{ FIREWALL_FRAGMENT_FILE }}"
    owner: root
    group: root
    mode: "0640"
    validate: "nft -c -f %s"

- name: "🚀 Firewall | Load the ruleset of '{{ FIREWALL_FRAGMENT_ROLE }}'"
  become: true
  ansible.builtin.command:
    argv: [nft, -f, "{{ FIREWALL_FRAGMENT_FILE }}"]
  changed_when: true

- name: "🔍 Firewall | Read back the table of '{{ FIREWALL_FRAGMENT_ROLE }}'"
  become: true
  ansible.builtin.command:
    argv: [nft, list, table, inet, "{{ FIREWALL_TABLE }}"]
  register: firewall_loaded_ruleset
  changed_when: false

- name: "✅ Firewall | Refuse a table that carries no chain"
  ansible.builtin.assert:
    that:
      - "'chain ' in firewall_loaded_ruleset.stdout"
    fail_msg: >-
      {{ FIREWALL_FRAGMENT_ROLE }} loaded {{ FIREWALL_TABLE }} but the table
      holds no chain, so nothing it declares is hooked into the packet path.
      A table that exists is not a rule that runs.