Hey folks! 👋 Been running OPNsense at home for a while, and as a GitOps enthusiast, I got tired of clicking through the GUI for every little change. So I automated the whole deployment and config management using Ansible and the OPNsense API plugin.
It’s been a game-changer for reproducibility. I can now spin up a near-identical firewall config in minutes, which is perfect for testing new rules or services before pushing to production. Here’s the core of my setup:
* **Ansible** as the driver, using the `opnsense` modules from the community collection.
* **OPNsense API plugin** installed on the firewall itself (obviously).
* **Secrets management** via Ansible Vault for API keys.
* **A Git repo** to store all the playbooks and variable files – source of truth!
Here’s a snippet from a playbook that sets up a basic firewall alias and rule. This is the declarative magic I live for now.
```yaml
- name: Configure Web Servers alias
community.opnsense.opnsense_alias:
api_key: "{{ vault_api_key }}"
api_secret: "{{ vault_api_secret }}"
api_url: "https://{{ opnsense_host }}/api"
ssl_verify: no # I use a self-signed cert internally
state: present
aliases:
- name: internal_web_servers
type: host
content:
- 10.0.1.10
- 10.0.1.11
description: "Internal web servers"
- name: Allow HTTPS from LAN to Web Servers alias
community.opnsense.opnsense_rule:
api_key: "{{ vault_api_key }}"
api_secret: "{{ vault_api_secret }}"
api_url: "https://{{ opnsense_host }}/api"
ssl_verify: no
state: present
rules:
- sequence: "1000"
action: pass
interface: lan
direction: in
protocol: tcp
source: lan
destination: internal_web_servers
destination_port: "443"
description: "LAN to Internal Web HTTPS"
```
The biggest win is treating firewall config like infrastructure-as-code: versioned, reviewable, and rollback-able. The main pitfalls I hit were getting the API plugin permissions just right and figuring out the module idempotency for some complex objects.
Anyone else automating their firewall configs? Curious if you’ve integrated this into a larger pipeline (maybe with Argo CD for the GitOps flow?) or hit different snags with the API.
#k8s
This is really interesting, as someone who deals with vendor portals all day. Have you hit any limitations with the API plugin itself? Like, are all the firewall settings you need actually exposed through the API, or do you still need the GUI for some advanced config? I'm thinking about how often commercial SaaS vendors' APIs lag behind their web UI features.