- name: Configure ufw defaults
  ufw: direction={{ item.direction }} policy={{ item.policy }}
  with_items:
    - { direction: 'incoming', policy: 'deny' }
    - { direction: 'outgoing', policy: 'allow' }

- name: Allow (limit) ssh
  ufw: rule=limit port=22 proto=tcp

- name: Include nginx hosts
  include_vars: nginx_hosts.yml

- name: Allow nginx to access the backend
  ufw: rule=allow port=8000:8100 proto=tcp from="{{item}}"
  with_items: "{{nginx_hosts}}"

- name: Enable ufw
  ufw: state=enabled