feat: add enable/disable flag to firewall::init

hieradata/common.yaml

@@ -351,6 +351,7 @@ profiles::ceph::client::mons:
 #      - prodinf01n22
 #      - repos.main.unkin.net
 
+firewall::enable: true
 firewall::ipset_queries:
   certbot: "enc_role=roles::infra::pki::certbot"
   cobbler: "enc_role=roles::infra::cobbler::server"

modules/firewall/manifests/init.pp

@@ -1,8 +1,10 @@
 # manage the firewall
 class firewall (
+  Boolean $enable = false,
   Hash $ipset_queries = {},
 ){
 
+  if $enable {
     $ipset_queries.each |$ipset, $query| {
       $ips = sort(query_nodes($query, 'networking.ip'))
 
@@ -23,4 +25,5 @@ class firewall (
       out_icmp  => true,
       out_all   => false,
     }
+  }
 }