pi-ansible/roles/os_config/tasks/firewall.yml

# vim: ft=yaml.ansible
---
- name: Allow necessary ports in UFW
  community.general.ufw:
    to_port: "{{ item.port }}"
    proto: "{{ item.proto }}"
    comment: "{{ item.comment }}"
    insert: "{{ ansible_loop.index }}"
    rule: allow
  loop: "{{ open_ports }}"
  loop_control:
    extended: true
    extended_allitems: false

- name: Enable UFW
  community.general.ufw:
    policy: deny
    state: enabled