feat: added ability to add custom nftables rules

group_vars/all/security.yaml

@@ -7,6 +7,9 @@ security_firewall_allowed_ports:
   - "443/udp"
   - "53/udp"
 
+# Optional per-host nftables additions appended verbatim to the rendered config
+security_nftables_custom_config: ""
+
 security_ssh_port: 2424
 security_fail2ban_enabled: true
 security_fail2ban_custom_configuration_template: "jail.local.j2"

roles/security/templates/nftables.conf.j2

@@ -32,3 +32,7 @@ table inet filter {
         policy accept;
     }
 }
+
+{% if security_nftables_custom_config is defined and security_nftables_custom_config | trim %}
+{{ security_nftables_custom_config | trim }}
+{% endif %}