Open services and ports on the managed nodes with ansible.posix.firewalld, see the difference between permanent and immediate, and do the same with the firewall system role.

Before you start

This VM is the control node. The lab creates the user greg (password Lab-Pass-1) with an SSH key, and installs ansible-core. Work as greg, in /home/greg/ansible: its ansible.cfg reads the inventory inventory, logs in as devops and becomes root. node1 is in the group webservers and node2 in dbservers. The ansible.posix collection and the system roles aren't installed yet.

The managed nodes node1 (10.99.1.11) and node2 (10.99.1.12) are AlmaLinux 10 containers, prepared as in chapter 3.1: devops takes greg's key and may use sudo without a password. Both run firewalld, and node1 runs a web server that the firewall blocks for now. For a root shell on a node, sudo podman exec -it node1 bash.

Tasks

Open HTTP and port 8080/tcp permanently and immediately on the web servers. curl http://node1/ works from this VM, and firewall-cmd --permanent --list-all on node1 lists both.
Add port 9090/tcp on the web servers with permanent: true only, and find it: --list-ports doesn't show it, --permanent --list-ports does. Then reload firewalld there, after which both do.
Use the firewall system role to allow mysql on the database servers. firewall-cmd --list-services on node2 includes mysql.

Hints

ansible-galaxy collection install ansible.posix for ansible.posix.firewalld: service or port, permanent, immediate, state: enabled.
ansible webservers -a 'firewall-cmd --reload', or a systemd_service task with state: reloaded.
The system roles come from the rhel-system-roles package on the control node; the role is redhat.rhel_system_roles.firewall, with the rules in the variable firewall. Its README is in /usr/share/doc/rhel-system-roles/firewall/.