From 06876b1d62641337186aff69b36dadd8f536ebc0 Mon Sep 17 00:00:00 2001
From: Melekhin Anton <antmelekhin@gmail.com>
Date: Sat, 14 Sep 2024 21:54:38 +0400
Subject: [PATCH] feat: add windows firewall settings

---
 defaults/main.yml           |  5 +++++
 meta/argument_specs.yml     | 18 ++++++++++++++++--
 tasks/Win32NT/configure.yml |  5 +++--
 3 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/defaults/main.yml b/defaults/main.yml
index bb5cffa..9484631 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -35,3 +35,8 @@ postgres_exporter_log_format: 'logfmt'
 postgres_exporter_tls_server_config: {}
 postgres_exporter_http_server_config: {}
 postgres_exporter_basic_auth_users: {}
+
+# The Postgres Exporter firewall settings:
+postgres_exporter_win_firewall_rule_profiles: 'domain,private,public'
+postgres_exporter_win_firewall_rule_remoteip: 'any'
+postgres_exporter_win_firewall_rule_state: 'present'
diff --git a/meta/argument_specs.yml b/meta/argument_specs.yml
index 855b673..2bbaca3 100644
--- a/meta/argument_specs.yml
+++ b/meta/argument_specs.yml
@@ -4,8 +4,7 @@ argument_specs:
     short_description: 'Postgres Exporter'
     description:
       - 'An Ansible role to install, configure and update the L(Postgres Exporter,https://github.com/prometheus-community/postgres_exporter).'
-    author:
-      - 'Melekhin Anton'
+    author: 'Melekhin Anton'
     options:
       postgres_exporter_version:
         type: 'str'
@@ -115,3 +114,18 @@ argument_specs:
       postgres_exporter_basic_auth_users:
         type: 'dict'
         description: 'Users and password for basic authentication. Passwords are automatically hashed with bcrypt.'
+      postgres_exporter_win_firewall_rule_profiles:
+        type: 'str'
+        description: 'The profile this rule applies to.'
+        default: 'domain,private,public'
+      postgres_exporter_win_firewall_rule_remoteip:
+        type: 'str'
+        description: 'The remote ip address/range this rule applies to.'
+        default: 'any'
+      postgres_exporter_win_firewall_rule_state:
+        type: 'str'
+        description: 'Should this rule be added or removed.'
+        choices:
+          - 'present'
+          - 'absent'
+        default: 'present'
diff --git a/tasks/Win32NT/configure.yml b/tasks/Win32NT/configure.yml
index 6f188f8..6a30186 100644
--- a/tasks/Win32NT/configure.yml
+++ b/tasks/Win32NT/configure.yml
@@ -44,9 +44,10 @@
     description: 'Inbound rule for Postgres Exporter'
     program: '{{ postgres_exporter_install_path }}\postgres_exporter.exe'
     localport: '{{ postgres_exporter_web_listen_port }}'
+    remoteip: '{{ postgres_exporter_win_firewall_rule_remoteip }}'
     action: 'allow'
     direction: 'in'
     protocol: 'tcp'
-    profiles: 'domain,private,public'
+    profiles: '{{ postgres_exporter_win_firewall_rule_profiles }}'
     enabled: true
-    state: 'present'
+    state: '{{ postgres_exporter_win_firewall_rule_state }}'