[ferm] Change default iptables backend to 'legacy'

(cherry picked from commit 0ec2812)

CHANGELOG.rst

@@ -74,6 +74,14 @@ Continuous Integration
                change. You might need to update your Ansible inventory to select
                the correct backend.
 
+- The default backend for :command:`iptables` is changed to ``legacy`` on newer
+  OS releases, because `there's no plans`__ to support :command:`nftables`
+  backend by the :command:`ferm` project. You might want to check if the
+  firewall configuration is correctly applied after running the role against
+  already configured hosts.
+
+  .. __: https://github.com/MaxKellermann/ferm/issues/47
+
 :ref:`debops.pki` role
 ''''''''''''''''''''''
 

ansible/roles/ferm/defaults/main.yml

@@ -62,7 +62,7 @@ ferm__iptables_backend_enabled: '{{ False
 #
 # Ferm does not support nftables backend, therefore the legacy variant is
 # enabled by default.
-ferm__iptables_backend_type: 'nft'
+ferm__iptables_backend_type: 'legacy'
 
                                                                    # ]]]
 # .. envvar:: ferm__base_packages [[[