From 823c0a0abe56599a79b8e70190d1f4386d9f1557 Mon Sep 17 00:00:00 2001
From: Sam Al-Sapti <sam@sapti.me>
Date: Tue, 1 Aug 2023 18:59:53 +0200
Subject: [PATCH] Add 443/UDP for http3

---
 group_vars/all/vars.yml            | 1 +
 roles/os_config/tasks/firewall.yml | 6 +++++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/group_vars/all/vars.yml b/group_vars/all/vars.yml
index a31089e..d82ca68 100644
--- a/group_vars/all/vars.yml
+++ b/group_vars/all/vars.yml
@@ -26,6 +26,7 @@ open_ports:
   - { port: '80', proto: 'tcp', comment: 'HTTP' }
   - { port: '81', proto: 'tcp', comment: 'Pi-hole (not port-forwarded)' }
   - { port: '443', proto: 'tcp', comment: 'HTTPS' }
+  - { port: '443', proto: 'udp', comment: 'HTTPS' }
   - { port: '4001', proto: 'tcp', comment: 'IPFS Kubo P2P' }
   - { port: '4001', proto: 'udp', comment: 'IPFS Kubo P2P' }
   - { port: '5001', proto: 'tcp', comment: 'IPFS Kubo RPC API (not port-forwarded)' }
diff --git a/roles/os_config/tasks/firewall.yml b/roles/os_config/tasks/firewall.yml
index 9f2ea3e..0d61bad 100644
--- a/roles/os_config/tasks/firewall.yml
+++ b/roles/os_config/tasks/firewall.yml
@@ -2,11 +2,15 @@
 ---
 - name: Allow necessary ports in UFW
   community.general.ufw:
-    rule: allow
     to_port: "{{ item.port }}"
     proto: "{{ item.proto }}"
     comment: "{{ item.comment }}"
+    insert: "{{ ansible_loop.index }}"
+    rule: allow
   loop: "{{ open_ports }}"
+  loop_control:
+    extended: true
+    extended_allitems: false
 
 - name: Enable UFW
   community.general.ufw: