ansible: Parametrise nftables config

ansible/roles/common_deb/defaults/main.yml

@@ -5,4 +5,8 @@ pam_use_kerberos: True
 backports_git: False
 backports: False
 nftables_default_config: True
+nftables:
+  snmp: false
+  nfs: false
+  pds_local: false
 dhcpcd: True

ansible/roles/common_deb/templates/nftables.conf.j2

@@ -29,10 +29,18 @@ table inet filter {
     # allow ssh, http(s)
     tcp dport { ssh, http, https } accept
 
+    {% if nftables.snmp %}
+    # snmp
+    udp dport { 161 } accept
+    {% endif %}
+
+    {% if nftables.nfs %}
     # NFS
     tcp dport { 111, 2049, 20048, 32765, 32766, 32803, 32769 } accept
     udp dport { 111, 2049, 20048, 32765, 32766, 32803, 32769 } accept
+    {% endif %}
 
+    {% if nftables.pds_local %}
     # local network
     ip saddr 147.251.51.160-147.251.51.255 accept
     ip saddr 147.251.48.89 accept # midas (Nikola)
@@ -41,8 +49,10 @@ table inet filter {
     # Local services (ident: 113, postgres: 5432)
     ip saddr 147.251.51.160-147.251.51.255 tcp dport { 113, 5432 } accept
     ip6 saddr 2001:718:801:233::a0-2001:718:801:233::ff tcp dport { 113, 5432 } accept
+    {% endif %}
 
     {{ nft_extra | default("") }}
+    {{ nftables.extra | default("") }}
 
     # everything else
     ip saddr 147.251.51.1-147.251.51.159 reject # junk from other labs