- name: copy firewall template
  become: true
  template:
    src: 'templates/nftables.j2'
    dest: '/etc/nftables.conf'
    owner: root
    group: root
    mode: '0644'
  notify: restart nftables