Problem: Disable does modify/delete

[3isenHeiM]

Modules

Rule

Version

1.2.12

Ansible Version

2.18.1

OPNSense Version

25.7.5

OPNSense-Plugin Version

Issue

Setting enabled: false on a existing rule will not disable it, it will simply remove

This is not the behavior of the WebUI of OPNsense, since disabled rules are still shown in gray.

Here is an example:

---
- name: Disable a Rule makes it disappear
  hosts: opnsense
  gather_facts: false

  collections:
    - ansibleguy.opnsense

  vars:
    # === Required connection details ===
    opnsense_host: 192.0.2.10        # e.g. firewall IP or FQDN
    opnsense_api_key: "YOUR_API_KEY"
    opnsense_api_secret: "YOUR_API_SECRET"
    opnsense_port: 443
    opnsense_ssl_verify: false       # set true if you have valid certs

  module_defaults:
    group/ansibleguy.opnsense.all:
      firewall:
        host: "{{ opnsense_host }}"
        port: "{{ opnsense_port }}"
        api_key: "{{ opnsense_api_key }}"
        api_secret: "{{ opnsense_api_secret }}"
        ssl_verify: "{{ opnsense_ssl_verify }}"

  tasks:
    - name: Create rule
      ansibleguy.opnsense.rule:
        interface: []
        source_net: 'test-network'
        destination_net: 'any'
        destination_port: 53
        protocol: 'UDP'
        description: 'new rule'
        match_fields: ['description']

    - name: Disable this rule
      ansibleguy.opnsense.rule:
        description: 'new rule'
        match_fields: ['description']
        enabled: false

Config Ansible

Config OPNSense

Debug Output

Profiling Output

[superstes]

Hmm.. on first glance I actually don't see a test for disabling: https://github.com/O-X-L/ansible-opnsense/blob/latest/tests%2Frule.yml

[superstes]

Greetings.

I just added test-cases for disabling/enabling and it works as I would expect it.

Maybe the issue is, that in your case, at the disabling step, there are rule-fields missing?
The module does not know that the user ONLY wants to disable the entry and thus will also change all differences.

This behavior might not be described clearly enough in the docs, what do you think? :scratch-kin-emoji:

    - name: Creating
      oxlorg.opnsense.rule:
        source_net: '192.168.0.0/24'
        destination_net: '192.168.2.0/24'
        destination_port: 8443
        protocol: 'UDP'
        description: 'ANSIBLE_TEST_1_1'
        interface: ['lan']  #  note: 'lo0' not accepted :(
        log: false
      register: opn4
      failed_when: >
        opn4.failed or
        not opn4.changed
      when: not ansible_check_mode

    - name: Disabling
      oxlorg.opnsense.rule:
        source_net: '192.168.0.0/24'
        destination_net: '192.168.2.0/24'
        destination_port: 8443
        protocol: 'UDP'
        description: 'ANSIBLE_TEST_1_1'
        interface: ['lan']  #  note: 'lo0' not accepted :(
        log: false
        enabled: false
      register: opn69
      failed_when: >
        opn69.failed or
        not opn69.changed
      when: not ansible_check_mode

    - name: Disabling - nothing changed
      oxlorg.opnsense.rule:
        source_net: '192.168.0.0/24'
        destination_net: '192.168.2.0/24'
        destination_port: 8443
        protocol: 'UDP'
        description: 'ANSIBLE_TEST_1_1'
        interface: ['lan']  #  note: 'lo0' not accepted :(
        log: false
        enabled: false
      register: opn70
      failed_when: >
        opn70.failed or
        opn70.changed
      when: not ansible_check_mode

    - name: Enabling
      oxlorg.opnsense.rule:
        source_net: '192.168.0.0/24'
        destination_net: '192.168.2.0/24'
        destination_port: 8443
        protocol: 'UDP'
        description: 'ANSIBLE_TEST_1_1'
        interface: ['lan']  #  note: 'lo0' not accepted :(
        log: false
        enabled: true
      register: opn71
      failed_when: >
        opn71.failed or
        not opn71.changed
      when: not ansible_check_mode

Results in:

TASK [Creating] ***********************************************************************************************
changed: [localhost]

TASK [Disabling] **********************************************************************************************
--- before
+++ after
@@ -1,3 +1,3 @@
 {
-    "enabled": true
+    "enabled": false
 }

changed: [localhost]

TASK [Disabling - nothing changed] ****************************************************************************
ok: [localhost]

TASK [Enabling] ***********************************************************************************************
--- before
+++ after
@@ -1,3 +1,3 @@
 {
-    "enabled": false
+    "enabled": true
 }

changed: [localhost]