Add firewalld_enabled toggle

roles/bootstrap/vars/main.yml

@@ -4,6 +4,7 @@ bootstrap_almalinux:
   - dbus-daemon
   - dhcp-client
   - efibootmgr
+  - "{{ 'firewalld' if firewalld_enabled | bool else '' }}"
   - glibc-langpack-de
   - glibc-langpack-en
   - grub2
@@ -33,7 +34,7 @@ bootstrap_archlinux:
   - dhcpcd
   - efibootmgr
   - fastfetch
-  - firewalld
+  - "{{ 'firewalld' if firewalld_enabled | bool else '' }}"
   - fish
   - fzf
   - grub
@@ -90,7 +91,7 @@ bootstrap_debian11:
     - bat
     - curl
     - entr
-    - firewalld
+    - "{{ 'firewalld' if firewalld_enabled | bool else '' }}"
     - fish
     - fzf
     - htop
@@ -139,7 +140,7 @@ bootstrap_debian12:
     - curl
     - duf
     - entr
-    - firewalld
+    - "{{ 'firewalld' if firewalld_enabled | bool else '' }}"
     - fish
     - fzf
     - htop
@@ -195,7 +196,7 @@ bootstrap_debian13:
     - duf
     - entr
     - fastfetch
-    - firewalld
+    - "{{ 'firewalld' if firewalld_enabled | bool else '' }}"
     - fish
     - fzf
     - htop
@@ -233,6 +234,7 @@ bootstrap_fedora:
   - duf
   - efibootmgr
   - entr
+  - "{{ 'firewalld' if firewalld_enabled | bool else '' }}"
   - fish
   - fzf
   - glibc-langpack-de
@@ -266,6 +268,7 @@ bootstrap_rhel8:
   - bind-utils
   - dhcp-client
   - efibootmgr
+  - "{{ 'firewalld' if firewalld_enabled | bool else '' }}"
   - glibc-langpack-de
   - glibc-langpack-en
   - grub2
@@ -291,6 +294,7 @@ bootstrap_rhel9:
   - bind-utils
   - dhcp-client
   - efibootmgr
+  - "{{ 'firewalld' if firewalld_enabled | bool else '' }}"
   - glibc-langpack-de
   - glibc-langpack-en
   - grub2
@@ -316,6 +320,7 @@ bootstrap_rhel9:
 bootstrap_rhel10:
   - bind-utils
   - efibootmgr
+  - "{{ 'firewalld' if firewalld_enabled | bool else '' }}"
   - glibc-langpack-de
   - glibc-langpack-en
   - grub2
@@ -343,6 +348,7 @@ bootstrap_rocky:
   - dbus-daemon
   - dhcp-client
   - efibootmgr
+  - "{{ 'firewalld' if firewalld_enabled | bool else '' }}"
   - glibc-langpack-de
   - glibc-langpack-en
   - grub2
@@ -394,7 +400,7 @@ bootstrap_ubuntu:
     - eza
     - fdupes
     - fio
-    - firewalld
+    - "{{ 'firewalld' if firewalld_enabled | bool else '' }}"
     - fish
     - htop
     - jq
@@ -457,7 +463,7 @@ bootstrap_ubuntu_lts:
     - eza
     - fdupes
     - fio
-    - firewalld
+    - "{{ 'firewalld' if firewalld_enabled | bool else '' }}"
     - fish
     - htop
     - jq

roles/configuration/tasks/services.yml

@@ -2,6 +2,7 @@
 - name: Enable Systemd Services
   ansible.builtin.command: >
     arch-chroot /mnt systemctl enable NetworkManager
+    {{ ' firewalld' if firewalld_enabled | bool else '' }}
     {{
       ' ssh' if os | lower in ['ubuntu', 'ubuntu-lts'] else
       (' sshd' if os | lower not in ['debian11', 'debian12', 'debian13'] else '')
@@ -12,3 +13,10 @@
     }}
   register: configuration_enable_services_result
   changed_when: configuration_enable_services_result.rc == 0
+
+- name: Disable firewalld when disabled
+  when: not firewalld_enabled | bool
+  ansible.builtin.command: arch-chroot /mnt systemctl disable --now firewalld
+  register: configuration_disable_firewalld_result
+  changed_when: configuration_disable_firewalld_result.rc == 0
+  failed_when: false

roles/global_defaults/defaults/main.yml

@@ -4,6 +4,7 @@ custom_iso: false
 cis: false
 selinux: true
 vmware_ssh: false
+firewalld_enabled: true
 
 cis_enabled: "{{ cis | bool }}"
 custom_iso_enabled: "{{ custom_iso | bool }}"