add vault

.gitignore

@@ -1 +1,2 @@
-ansible/vault_password
+ansible/vault_password
+ansible/inventory/group_vars/vault.yml

ansible/inventory/host_vars/lab.yaml

@@ -4,6 +4,7 @@
 
 ansible_user: ladmin
 ansible_become_user: root
+ansible_become_pass: "{{ lab_become_password }}"
 ansible_os_family: Arch
 
 # sshd

ansible/playbooks/lab.yaml

@@ -6,4 +6,5 @@
 
   roles:
     - python
-    - sshd
+    - sshd
+    - firewall

ansible/roles/firewall/defaults/main.yml

@@ -0,0 +1,2 @@
+---
+firewall_package: ufw

ansible/roles/firewall/tasks/main.yml

@@ -0,0 +1,10 @@
+---
+- name: install ufw arch
+  become: true
+  community.general.pacman:
+    name: "{{ firewall_package }}"
+    state: latest
+    update_cache: true
+    reason: explicit
+  when:
+    - ansible_os_family == 'Arch'