---
# Tasks to configure firewalld rules

- name: All enabled ports
  debug: var=firewalld_ports

# need root
- name: determine if firewalld is running
  command: bash -c 'firewall-cmd --state || exit 0'
  register: firewalld_running
  ignore_errors: true
  changed_when: false

- name: enable firewalld ports
#  shell: firewall-cmd --zone=public --add-port={{ item }} --permanent
  firewalld:
    port: '{{ item }}'
    permanent: true
    state: enabled
  when: firewalld_running.stdout.strip() == "running"
  with_items: "{{ firewalld_ports }}"
  register: firewalld

- name: reload firewalld
  # shell: firewall-cmd --reload
  service: name=firewalld state=reloaded
  when: firewalld.changed is defined and firewalld.changed