david_igou.routeros_configuration.configure role – Declaratively manage RouterOS paths from one data structure.

Note

This role is part of the david_igou.routeros_configuration collection (version 0.0.8-alpha).

It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it use: ansible-galaxy collection install david_igou.routeros_configuration.

To use it in a playbook, specify: david_igou.routeros_configuration.configure.

Entry point main – Declaratively manage RouterOS paths from one data structure.

Synopsis

  • Reconciles each path in routeros_config via the internal _reconcile engine, in a canonical dependency order (see vars/main.yml).

Parameters

Parameter

Comments

routeros_config

dictionary

Desired state keyed by RouterOS slash path (e.g. /ip/pool). Each value is a dict with these keys (argument_specs cannot validate the nested dict-of-dicts; see the role README for the authoritative contract and examples)

data (list, required) — desired entries for the path.

purge (bool, default false) — remove on-device entries not in data.

order (bool, default false) — enforce entry order; requires purge.

content (str, default ignore) — one of ignore/remove/remove_as_much_as_possible; how to treat fields absent from a matched entry.

Default: {}

Examples

# Minimal: set the identity and an address pool. Each key is a RouterOS
# slash path with a data list of the desired entries.
- hosts: routers
  gather_facts: false
  roles:
    - role: david_igou.routeros_configuration.configure
      vars:
        routeros_config:
          /system/identity:
            data:
              - name: edge-router
          /ip/pool:
            data:
              - name: lan-pool
                ranges: 192.168.88.10-192.168.88.254

# Several paths: keys may be authored in any order; the role re-sorts them
# into a canonical dependency order, so the pool is applied before the DHCP
# server that references it.
- hosts: routers
  gather_facts: false
  roles:
    - role: david_igou.routeros_configuration.configure
      vars:
        routeros_config:
          /ip/dhcp-server:
            data:
              - name: lan-dhcp
                interface: bridge
                address-pool: lan-pool
          /ip/pool:
            data:
              - name: lan-pool
                ranges: 192.168.88.10-192.168.88.254
          /ip/dns:
            data:
              - servers: 1.1.1.1,9.9.9.9
                allow-remote-requests: true

# Exact firewall state: purge removes on-device entries absent from data;
# order (requires purge) enforces rule order. Review a --check --diff run
# before applying purge/order to a production chain.
- hosts: routers
  gather_facts: false
  roles:
    - role: david_igou.routeros_configuration.configure
      vars:
        routeros_config:
          /ip/firewall/filter:
            purge: true
            order: true
            content: remove_as_much_as_possible
            data:
              - chain: input
                action: accept
                connection-state: "established,related"
                comment: est
              - chain: input
                action: accept
                protocol: tcp
                dst-port: "22,8728"
                comment: mgmt
              - chain: input
                action: drop
                comment: drop-rest