Same reason as mentioned below:
Currently we need to restart all docker containers to recreate the "foreign" nft tables created by iptables-nft. I find it rather inconvenient to blow away and...
Yeah, we currently don't have any handlers. I remove this part. 😉
Well, currently we need to restart all docker containers to recreate the "foreign" nft tables created by iptables-nft. I find it rather inconvenient to blow away and start up all docker hosted...
No, just some copy and pasta from my current setup. 🙈
Preliminary review: I've not tested your role, yet.
You can use the ansible.builtin.service_facts module if you like. The downside, it's slower. 🙈
Can you add a systemd override file that replaces the ExecStop command to not touch foreign nft tables?
Maybe merge with task Enable nftables above for faster execution?
You can use nftables sets to manage both tcp and udp ports:
Maybe do not use flush ruleset. Instead only remove nft tables managed by this file?
fussel178/docs/readme from ProcNULL/ansible-general
unattended_upgrades