<commit_before>---
  # Do NOT!!! reload the production iptables rules during the first
  # installation. They will break the ssh connection and because of
  # that it will break the installation leaving you with no remote
  # access to the server. If this happens will need console access
  # to recover access.
  #
  # The staging exemptions will reload the iptables rules after the exemptions
  # are put in place
  #
  # For production systems the iptables rules will not be loaded until the
  # server is rebooted. This also means that any updates to the firewall in the
  # future will require a restart.
  #
  # The process should be re-designed so the iptables rules are not applied in
  # bulk. When that is done this issue will be avoided.

- name: Gather localhost facts first
  setup:
  become: no
  delegate_to: localhost
  delegate_facts: True
  run_once: True

- name: Copy load_iptables if-up script.
  copy:
    src: load_iptables
    dest: /etc/network/if-up.d/load_iptables
    owner: root
    mode: "0744"

- name: Create iptables directory.
  file:
    state: directory
    mode: "0700"
    owner: root
    group: root
    dest: /etc/network/iptables

- name: Determine local platform specific routing info
  set_fact:
    admin_route_map: "{{ admin_net_int[hostvars['localhost']['ansible_system']] }}"

- name: Record admin network interface
  set_fact:
    admin_dev: "{{ lookup('pipe',admin_route_map.cmd+ssh_ip)|regex_search(admin_route_map.rgx) }}"
  when: not enable_ssh_over_tor

- name: Compute admin network CIDR
  set_fact:
    admin_net_cidr: "{{ '/'.join([hostvars['localhost']['ansible_'+admin_dev].ipv4.network,
                        hostvars['localhost']['ansible_'+admin_dev].ipv4.netmask]
                        )|ipaddr('cidr') }}"
  delegate_to: localhost
  when: not enable_ssh_over_tor

- name: Copy IPv4 iptables rules.
  template:
    src: rules_v4
    dest: /etc/network/iptables/rules_v4
    owner: root
    mode: "0644"
  notify: drop flag for reboot

- name: Copy IPv6 iptables rules.
  copy:
    src: iptables_rules_v6
    dest: /etc/network/iptables/rules_v6
    owner: root
    mode: "0644"<commit_msg>Attempt to fix Mac/Linux variable divergence<commit_after>---
  # Do NOT!!! reload the production iptables rules during the first
  # installation. They will break the ssh connection and because of
  # that it will break the installation leaving you with no remote
  # access to the server. If this happens will need console access
  # to recover access.
  #
  # The staging exemptions will reload the iptables rules after the exemptions
  # are put in place
  #
  # For production systems the iptables rules will not be loaded until the
  # server is rebooted. This also means that any updates to the firewall in the
  # future will require a restart.
  #
  # The process should be re-designed so the iptables rules are not applied in
  # bulk. When that is done this issue will be avoided.

- name: Gather localhost facts first
  setup:
  become: no
  delegate_to: localhost
  delegate_facts: True

- name: Copy load_iptables if-up script.
  copy:
    src: load_iptables
    dest: /etc/network/if-up.d/load_iptables
    owner: root
    mode: "0744"

- name: Create iptables directory.
  file:
    state: directory
    mode: "0700"
    owner: root
    group: root
    dest: /etc/network/iptables

- name: Determine local platform specific routing info
  set_fact:
    admin_route_map: "{{ admin_net_int[hostvars['localhost']['ansible_system']] }}"

- name: Record admin network interface
  set_fact:
    admin_dev: "{{ lookup('pipe',admin_route_map.cmd+ssh_ip)|regex_search(admin_route_map.rgx) }}"

# this is a weird work-around for an issue I found with Mac reporting the interface
# wrapped in a list, rather than just a dict :shrug:
- name: Hacky work-around for Mac/Linux interface structure divergence
  set_fact:
    admin_net_info: "{{ hostvars['localhost']['ansible_'+admin_dev].ipv4[0] | default(
                        hostvars['localhost']['ansible_'+admin_dev].ipv4) }}"

- name: Compute admin network CIDR
  set_fact:
    admin_net_cidr: "{{ '/'.join([admin_net_info.network, admin_net_info.netmask])|ipaddr('cidr') }}"
  delegate_to: localhost

- name: Copy IPv4 iptables rules.
  template:
    src: rules_v4
    dest: /etc/network/iptables/rules_v4
    owner: root
    mode: "0644"
  notify: drop flag for reboot

- name: Copy IPv6 iptables rules.
  copy:
    src: iptables_rules_v6
    dest: /etc/network/iptables/rules_v6
    owner: root
    mode: "0644"
{'fraction_non_alphanumeric': 0.08809891808346214, 'fraction_numerical': 0.010819165378670788, 'mean_word_length': 3.4109055501460563, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2655684', 'n_tokens_mistral': 1466, 'n_tokens_neox': 1407, 'n_words': 487}