Implementing composite firewall rules thanks to setup module with complex values

iptables.j2

#
# Example trimmed for brevity.
#
#
# ######################################
# INPUT Dispatch
# ######################################
-A INPUT -p tcp -j TCP_IN 
-A INPUT -p udp -j UDP_IN 
-A INPUT -p icmp -j ICMP_IN 
-A INPUT -j STATEFUL
#
# ######################################
# STATEFUL
# ######################################
-A STATEFUL -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A STATEFUL -j DROP_ME 
#
# ######################################
# TCP INPUT RULES
# ######################################
-A TCP_IN -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j DROP_ME
{% for rule in firewall_tcp_in %}
-A TCP_IN -p tcp -m tcp {{ rule }} -j ACCEPT
{% endfor %}
-A TCP_IN -j STATEFUL
#
# ######################################
# TCP OUTPUT RULES
# ######################################
{% for rule in firewall_tcp_out %}
-A TCP_OUT -p tcp -m tcp {{ rule }} -j ACCEPT
{% endfor %}
-A TCP_OUT -p tcp -m tcp -j STATEFUL
#
...
COMMIT

playbook

-hosts: all
 template src=/srv/iptables.j2 dest=/etc/network/iptables owner=root group=root mode=0600

yaml_inventory

---
- group base
  hosts: 
  - all
  vars:
    firewall_tcp_in:
      # allow sysadmins to ssh in
      - "--dport 22 -s 10.10.1.1/32 -j ACCEPT"
      - "--dport 22 -s 10.10.1.7/32 -j ACCEPT"
    firewall_tcp_out:
      # allow ntp out
      - "--dport 123 -d 1.2.3.4/32 -j ACCEPT"
    firewall_udp_out:
      # allow name resolution
      - "--dport 53 -d 4.3.2.1/32 -j ACCEPT"

- group webservers
  hosts:
  - somewebserver
  - someotherwebserver
  vars:
    firewall_tcp_in:
      # open port 80 and 443
      - "-m tcp -p tcp --dport 80 -j ACCEPT"
      - "-m tcp -p tcp --dport 443 -j ACCEPT"