ceph-ansible/roles/ceph-infra/handlers/main.yml

---
- name: restart firewalld
  service:
    name: firewalld
    state: restarted
    enabled: yes
  when:
    - ansible_facts['services']['firewalld.service'] is defined
    - ansible_facts['services']['firewalld.service']['state'] != 'masked'