---
- name: install iptables and iptables-persistent
  tags: routing
  become: yes
  apt:
    name: [iptables, iptables-persistent]
    state: present

- name: add ssh DNAT rule for containers
  tags: routing
  iptables:
    table: nat
    chain: PREROUTING
    in_interface: "{{ host_iface }}"
    protocol: tcp
    match: tcp
    source: "{{ (host_ipt_ssh_cidr is defined) | ternary(host_ipt_ssh_cidr, '0.0.0.0/0')  }}"
    jump: DNAT
    destination_port: "{{ hostvars[item]['ansible_port'] }}"
    to_destination: "{{ hostvars[item]['internal_ip'] }}"
  become: yes
  with_items: "{{ groups['containers'] }}"

- debug:
    var: groups['containers']
  tags: routing

- name: add http and https rules for haproxy container
  when: "'haproxy' in groups['containers']"
  tags: routing
  iptables:
    table: nat
    chain: PREROUTING
    in_interface: "{{ host_iface }}"
    protocol: tcp
    match: tcp
    source: "{{ (host_ipt_ssh_cidr is defined) | ternary(host_ipt_ssh_cidr, '0.0.0.0/0')  }}"
    jump: DNAT
    destination_port: "{{ item }}"
    to_destination: "{{ hostvars['haproxy']['internal_ip'] }}"
  become: yes
  loop: [ 80, 443 ]

- name: save DNAT rules on lxd host
  tags: routing
  become: yes
  community.general.iptables_state:
    table: nat
    state: saved
    path: /etc/iptables/rules.v4