ansible/oopen-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Inventory cleanup; add ipt-server host_vars for all ipt hosts.

Browse Source 
- hosts: remove unreachable/decommissioned hosts (file-ah-neu, file-ah-alt,
  file-km-neu, ga-al-gw-neu, gw-opp-neu, zapata-neu, zapata-alt, bbb-server,
  ki-fm, server28, ...) and duplicate aliases (etherpad = b.ns,
  cl-irights-neu = cl-irights, oolm-db = o21, devel-ruby = devel-todo).
- host_vars: add <short>-ipt-server.yml (fw_manage_config: false) for all
  hosts running the ipt-server firewall, generated by extract-fw-host-vars.py.
- host_vars: move/remove obsolete host directories, replace alias
  directories by symlinks (cl-lubax -> o32, cl-vbrg -> o34, oolm-db -> o21).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
chris
2026-11-03 23:08:58 +01:00
co-authored by Claude Opus 5.5
parent 8484fd1508
commit 3a73ed9583
126 changed files with 3350 additions and 2970 deletions
Download Patch File Download Diff File Expand all files Collapse all files
host_vars/bbb-server.b3-bornim.netz/bbb-server-common.yml → host_vars/DELETED/bbb-server.b3-bornim.netz/bbb-server-common.yml
View File
host_vars/server28.warenform.de/server28-common.yml → host_vars/DELETED/cl-vbrg.oopen.de/cl-vbrg-common.yml
+66 -52
View File
@@ -4,7 +4,6 @@
# vars used by roles/network_interfaces
# ---
# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
network_manage_devices: true
@@ -22,9 +21,9 @@ network_interface_required_packages:
network_interfaces:
- device: enp9s0
- device: enp6s0
# use only once per device (for the first device entry)
headline: enp9s0 - primary network interface
headline: enp6s0 - primary network interface
# auto & allow are only used for the first device entry
allow: [] # array of allow-[stanzas] eg. allow-hotplug
@@ -34,9 +33,9 @@ network_interfaces:
method: static
hwaddress:
description:
address: 116.202.161.37
address: 65.109.158.101
netmask: 26
gateway: 116.202.161.1
gateway: 65.109.158.65
metric:
pointopoint:
mtu:
@@ -64,9 +63,9 @@ network_interfaces:
# search: warenform.de
#
# nameservers:
# - 213.133.99.99
# - 213.133.98.98
# - 213.133.100.100
# - 127.0.0.1
# - 185.12.64.2
# - 2a01:4ff:ff00::add:1
# search:
# optional additional subnets/ips subnets: []
@@ -98,23 +97,23 @@ network_interfaces:
# optional vlan settings | vlan: {}
# vlan: {}
# raw-device: 'eth0'
# raw-device: 'enp6s0'
vlan: {}
# inline hook scripts
pre-up: [] # pre-up script lines
up:
- !!str "route add -net 116.202.161.0 netmask 255.255.255.192 gw 116.202.161.1 dev enp9s0" # up script lines
- route add -net 65.109.158.64 netmask 255.255.255.192 gw 65.109.158.65 dev enp6s0
post-up: [] # post-up script lines (alias for up)
pre-down: [] # pre-down script lines (alias for down)
down: [] # down script lines
post-down: [] # post-down script lines
- device: enp9s0
- device: enp6s0
family: inet6
method: static
address: 2a01:4f8:241:15a::2
address: 2a01:4f9:3080:155d::2
netmask: 64
gateway: fe80::1
@@ -143,11 +142,6 @@ network_interfaces:
# vars used by roles/common/tasks/apt.yml
# ---
apt_install_extra_pkgs: true
apt_extra_pkgs:
- subversion
- subversion-tools
# ---
# vars used by roles/common/tasks/systemd-resolved.yml
@@ -200,11 +194,9 @@ systemd_resolved: true
# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
resolved_nameserver:
- 213.133.100.100
- 2a01:4f8:0:1::add:9898
- 213.133.99.99
- 2a01:4f8:0:1::add:1010
- 195.201.179.131
- 95.217.204.204
- 213.133.98.98
- 2a01:4f8:0:1::add:9999
# search domains
#
@@ -214,7 +206,7 @@ resolved_nameserver:
# resolved_domains: []
resolved_domains:
- ~.
- warenform.de
- oopen.de
resolved_dnssec: false
@@ -223,6 +215,11 @@ resolved_dnssec: false
resolved_fallback_nameserver:
- 194.150.168.168
# ---
# vars used by roles/common/tasks/cron.yml
# ---
cron_env_entries:
- name: PATH
job: /root/bin/admin-stuff;/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
@@ -244,17 +241,17 @@ cron_user_special_time_entries:
job: "sleep 10 ; /root/bin/monitoring/check_postfix.sh > /dev/null 2>&1"
insertafter: PATH
- name: "Restart prosody Service."
special_time: reboot
job: "sleep 120 ; systemctl stop prosody ; sleep 10 ; systemctl start prosody"
insertafter: PATH
cron_user_entries:
- name: "Check if SSH service is running. Restart service if needed."
- name: "Check if webservices sre running. Restart if necessary"
minute: '*/5'
hour: '*'
job: /root/bin/monitoring/check_webservice_load.sh
- name: "Check if SSH service is running. Restart service if needed."
minute: '*/10'
hour: '*'
job: /root/bin/monitoring/check_ssh.sh
- name: "Check connectifity - reboot if needed"
@@ -267,25 +264,45 @@ cron_user_entries:
hour: '*'
job: /root/bin/monitoring/check_postfix.sh
- name: "Check Postfix E-Mail LOG file for 'fatal' errors.."
minute: '*/5'
hour: '*'
job: /root/bin/postfix/check-postfix-fatal-errors.sh
- name: "Check if NTP service 'ntpsec' is up and running?"
minute: '*/30'
hour: '*'
job: /root/bin/monitoring/check_ntpsec_service.sh > /dev/null 2>&1
- name: "Check hard disc usage."
minute: '43'
hour: '6'
job: /root/bin/admin-stuff/check-disc-usage.sh -c 85
- name: "Optimize mysql tables"
minute: '53'
hour: '04'
job: /root/bin/mysql/optimize_mysql_tables.sh
- name: "Check if cert(s) for Prosody service are up-zp-date"
minute: '13'
hour: '05'
job: /root/bin/monitoring/check_cert_for_prosody.sh
- name: "Flush query cache for mysql tables"
minute: '27'
hour: '04'
job: /root/bin/mysql/flush_query_cache.sh
- name: "Check if cert for coTURN service is up-to-date"
minute: '39'
- name: "Flush Host cache"
minute: '17'
hour: '05'
job: /root/bin/monitoring/check_cert_for_service.sh
job: /root/bin/mysql/flush_host_cache.sh
- name: "Run occ file:scan for each cloud account"
minute: '03'
hour: '23'
job: /root/bin/nextcloud/occ_maintenance.sh -s cloud.verband-brg.de
- name: "Background job for nextcloud instance 'cloud.verband-brg.de"
minute: '*/15'
hour: '*'
job: sudo -u "www-data" /usr/local/php/bin/php -f /var/www/cloud.verband-brg.de/htdocs/cron.php
- name: "Check if certificates for coolwsd service are up to date"
minute: '17'
hour: '05'
job: /root/bin/nextcloud/check_cert_coolwsd.sh
- name: "Generate/Renew Let's Encrypt Certificates if needed (using dehydrated script)"
minute: '23'
@@ -297,6 +314,11 @@ cron_user_entries:
hour: '05'
job: /var/lib/dehydrated/tools/update_ssl_directives.sh
- name: "Check hard disc usage."
minute: '43'
hour: '6'
job: /root/bin/admin-stuff/check-disc-usage.sh -c 85
# ---
# vars used by roles/common/tasks/users.yml
@@ -319,18 +341,11 @@ cron_user_entries:
#
# see: roles/common/tasks/vars
# ---
# vars used by roles/common/tasks/copy_files.yml
# ---
copy_plain_files:
# /root/bin/monitoring
#
- name: admin_stuff_check_disc_usage
src_path: server28.warenform.de/root/bin/admin-stuff/conf/check-disc-usage.conf
dest_path: /root/bin/admin-stuff/conf/check-disc-usage.conf
sudoers_file_user_privileges:
- name: back
entry: 'ALL=(www-data) NOPASSWD: /usr/local/php/bin/php'
- name: www-data
entry: 'ALL=(root) NOPASSWD: /root/bin/nextcloud/add-new-account.sh'
# ---
@@ -347,7 +362,6 @@ git_firewall_repository:
repo: https://git.oopen.de/firewall/ipt-server
dest: /usr/local/src/ipt-server
# ==============================
host_vars/DELETED/cl-vbrg.oopen.de/cl-vbrg-ipt-server.yml
+33
View File
@@ -0,0 +1,33 @@
---
# ipt-firewall configuration for o34.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: true
# --- Network
fw_ext_interfaces:
- "enp6s0"
fw_ext_ips_v4:
- "65.109.158.101"
fw_ext_ips_v6:
- "2a01:4f9:3080:155d::2"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Bridged / LXC
fw_do_not_firewall_bridged_traffic: true
# --- HTTP
fw_http_server_ips: $ext_1_ip
# --- Mail
fw_mail_client_ips: $ext_1_ip
# --- FTP
fw_ftp_server_ips: $ext_1_ip
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/backup.oopen.de/backup-common.yml
+1
View File
@@ -289,6 +289,7 @@ default_user:
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL7KbEZApiqEcU4aK3A2J8hy+r1uV7TZupwm4CHGqLPH root@ga-gh-gw'
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICCXqgmGcJfUDROAk24pTkQqddRj1sh1BW3JrbHu7ZtE root@ga-nh-gw'
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBaF9IsDzPo6nef47VbsLlqlmiwuLyFQ8Vawil/JPF9M root@ga-st-gw'
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK0kp3X3Qa/TD5XnVD9pkVj03F1EuG8g2SuhFceUKVk0 root@ga-st-mail'
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJPbony+4g4iFS32Cv/Bkmet4FsCAsrGTffwWm2eM16x root@git.warenform'
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDqqmBWh3qmnx41NiLCn1LhVG0mn4++IUvRNC0OMh6h6 root@gitoea'
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICR9o0+6jnfmXKOedKP6IZgt5lRIPFSJJ4FbMjz2SPkH root@gw-campus'
host_vars/backup.so36.net/backup-ipt-server.yml
+21
View File
@@ -0,0 +1,21 @@
---
# ipt-firewall configuration for backup.so36.net
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "enp2s0"
fw_ext_ips_v4:
- "194.150.169.138"
fw_ext_ips_v6:
- "2001:4ce8:b134:8680::2"
# --- Munin
munin_remote_ipv4: 192.68.11.73
munin_remote_ipv6: "2001:678:a40:3000::73"
# --- SSH
fw_ssh_ports: 1036
host_vars/c.mx.oopen.de/c.mx-ipt-server.yml
+38
View File
@@ -0,0 +1,38 @@
---
# ipt-firewall configuration for c.mx.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
- "eth1"
fw_ext_ips_v4:
- "83.223.86.116"
- "83.223.86.117"
fw_ext_ips_v6:
- "2a01:30:0:13:2c5:48ff:feee:f21c 2a01:30:0:505:2c5:48ff:feee:f21c"
- "2a01:30:0:13:2c5:48ff:feee:f21d 2a01:30:0:505:2c5:48ff:feee:f21d"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- HTTP
fw_http_server_ips: $ext_1_ip $ext_2_ip
# --- Mail
fw_smtpd_ips: $ext_1_ip
fw_mail_server_ips: $ext_1_ip
fw_mail_client_ips: $ext_1_ip
fw_dovecot_auth_service: true
fw_dovecot_auth_allowed_networks_v4: 83.223.85.204
fw_dovecot_auth_allowed_networks_v6: "2a01:30:0:13::/64"
# --- Rsync
fw_rsync_out_ips: $ext_1_ip
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/ki-fm.oopen.de/ki-fm-ipt-server.yml → host_vars/cl-exil.oopen.de/cl-exil-ipt-server.yml
+5 -5
View File
@@ -1,17 +1,17 @@
---
# ipt-firewall configuration for cl-fm.oopen.de
# ipt-firewall configuration for cl-exil.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/ipt_firewall.yml
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: true
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "5.75.224.214"
- "5.9.97.99"
fw_ext_ips_v6:
- "2a01:4f8:c015:c4b7::1"
- "2a01:4f8:162:2477::99"
# --- Munin
munin_remote_ipv4: 37.27.121.227
host_vars/cl-lubax.oopen.de
Symlink
+1
View File
@@ -0,0 +1 @@
o32.oopen.de
host_vars/cl-lubax.oopen.de/cl-lubax-common.yml
-151
View File
@@ -1,151 +0,0 @@
---
# ---
# vars used by roles/ansible_dependencies
# ---
# ---
# vars used by roles/ansible_user
# ---
# ---
# vars used by roles/common/tasks/basic.yml
# ---
# ---
# vars used by roles/common/tasks/sshd.yml
# ---
# sshd_permit_root_login: !!str "prohibit-password"
sshd_permit_root_login: !!str "no"
# ---
# vars used by apt.yml
# ---
# ---
# vars used by roles/common/tasks/systemd-resolved.yml
# ---
systemd_resolved: false
# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
# Primäre DNS-Adresse: 38.132.106.139
# Sekundäre DNS-Adresse: 194.187.251.67
#
# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
# primäre DNS-Adresse
# IPv4: 1.1.1.1
# IPv6: 2606:4700:4700::1111
# sekundäre DNS-Adresse
# IPv4: 1.0.0.1
# IPv6: 2606:4700:4700::1001
#
# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
# primäre DNS-Adresse
# IPv4: 8.8.8.8
# IPv6: 2001:4860:4860::8888
# sekundäre DNS-Adresse
# IPv4: 8.8.4.4
# IPv6: 2001:4860:4860::8844
#
# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
# primäre DNS-Adresse
# IPv4: 9.9.9.9
# IPv6: 2620:fe::fe
# sekundäre DNS-Adresse
# IPv4: 149.112.112.112
# IPv6: 2620:fe::9
#
# OpenNIC - https://www.opennic.org/
# IPv4: 195.10.195.195 - ns31.de
# IPv4: 94.16.114.254 - ns28.de
# IPv4: 51.254.162.59 - ns9.de
# IPv4: 194.36.144.87 - ns29.de
# IPv6: 2a00:f826:8:2::195 - ns31.de
#
# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
# IPv4: 5.1.66.255
# IPv6: 2001:678:e68:f000::
# Servername für DNS-over-TLS: dot.ffmuc.net
# IPv4: 185.150.99.255
# IPv6: 2001:678:ed0:f000::
# Servername für DNS-over-TLS: dot.ffmuc.net
# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
resolved_nameserver:
- 185.12.64.2
- 2a01:4ff:ff00::add:1
- 185.12.64.1
- 2a01:4ff:ff00::add:2
# search domains
#
# If there are more than one search domains, then specify them here in the order in which
# the resolver should also search them
#
# resolved_domains: []
resolved_domains:
- ~.
- oopen.de
resolved_dnssec: false
# dns.as250.net: 194.150.168.168
#
resolved_fallback_nameserver:
- 194.150.168.168
# ---
# vars used by roles/common/tasks/users.yml
# ---
sudo_users:
- chris
- sysadm
- localadmin
# ---
# vars used by roles/common/tasks/users-systemfiles.yml
# ---
# ---
# vars used by roles/common/tasks/webadmin-user.yml
# ---
# ---
# vars used by roles/common/tasks/sudoers.yml
# ---
#
# see: roles/common/tasks/vars
sudoers_file_user_privileges:
- name: back
entry: 'ALL=(www-data) NOPASSWD: /usr/local/php/bin/php'
# ---
# vars used by roles/common/tasks/caching-nameserver.yml
# ---
# ---
# vars used by roles/common/tasks/git.yml
# ---
#
# see: roles/common/tasks/vars
# ==============================
# ---
# vars used by scripts/reset_root_passwd.yml
# ---
host_vars/cl-nd.oopen.de/cl-nd-ipt-server.yml
+24
View File
@@ -0,0 +1,24 @@
---
# ipt-firewall configuration for cl-nd.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "148.251.194.56"
fw_ext_ips_v6:
- "2a01:4f8:211:f89::56"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- HTTP
fw_http_server_ips: $ext_1_ip
# --- Mail
fw_mail_client_ips: $ext_1_ip
host_vars/cl-opp.oopen.de/cl-opp-ipt-server.yml
+27
View File
@@ -0,0 +1,27 @@
---
# ipt-firewall configuration for cl-opp.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "213.239.199.45"
fw_ext_ips_v6:
- "2a01:4f8:222:161c::45"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- HTTP
fw_http_server_ips: $ext_1_ip
# --- Mail
fw_mail_client_ips: $ext_1_ip
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/cl-vbrg.oopen.de
Symlink
+1
View File
@@ -0,0 +1 @@
o34.oopen.de
host_vars/cl-vbrg.oopen.de/cl-vbrg-common.yml
-72
View File
@@ -1,72 +0,0 @@
---
# ---
# vars used by roles/ansible_dependencies
# ---
# ---
# vars used by roles/ansible_user
# ---
# ---
# vars used by roles/common/tasks/basic.yml
# ---
# ---
# vars used by roles/common/tasks/sshd.yml
# ---
sshd_permit_root_login: !!str "prohibit-password"
# ---
# vars used by apt.yml
# ---
# ---
# vars used by roles/common/tasks/users.yml
# ---
# ---
# vars used by roles/common/tasks/users-systemfiles.yml
# ---
# ---
# vars used by roles/common/tasks/webadmin-user.yml
# ---
# ---
# vars used by roles/common/tasks/sudoers.yml
# ---
#
# see: roles/common/tasks/vars
sudoers_file_user_privileges:
- name: back
entry: 'ALL=(www-data) NOPASSWD: /usr/local/php/bin/php'
# ---
# vars used by roles/common/tasks/caching-nameserver.yml
# ---
# ---
# vars used by roles/common/tasks/git.yml
# ---
#
# see: roles/common/tasks/vars
# ==============================
# ---
# vars used by scripts/reset_root_passwd.yml
# ---
host_vars/cloud-giz.warenform.de/cloud-giz-common.yml
-72
View File
@@ -1,72 +0,0 @@
---
# ---
# vars used by roles/ansible_dependencies
# ---
# ---
# vars used by roles/ansible_user
# ---
# ---
# vars used by roles/common/tasks/basic.yml
# ---
# ---
# vars used by roles/common/tasks/sshd.yml
# ---
sshd_permit_root_login: !!str "prohibit-password"
# ---
# vars used by apt.yml
# ---
# ---
# vars used by roles/common/tasks/users.yml
# ---
# ---
# vars used by roles/common/tasks/users-systemfiles.yml
# ---
# ---
# vars used by roles/common/tasks/webadmin-user.yml
# ---
# ---
# vars used by roles/common/tasks/sudoers.yml
# ---
#
# see: roles/common/tasks/vars
sudoers_file_user_privileges:
- name: back
entry: 'ALL=(www-data) NOPASSWD: /usr/local/php/bin/php'
# ---
# vars used by roles/common/tasks/caching-nameserver.yml
# ---
# ---
# vars used by roles/common/tasks/git.yml
# ---
#
# see: roles/common/tasks/vars
# ==============================
# ---
# vars used by scripts/reset_root_passwd.yml
# ---
host_vars/cloud.akweb.de/cloud-ipt-server.yml
+27
View File
@@ -0,0 +1,27 @@
---
# ipt-firewall configuration for cloud.akweb.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "148.251.14.141"
fw_ext_ips_v6:
- "2a01:4f8:201:7389::141"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- HTTP
fw_http_server_ips: $ext_1_ip
# --- Mail
fw_mail_client_ips: $ext_1_ip
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/comm.so36.net/comm-ipt-server.yml
+41
View File
@@ -0,0 +1,41 @@
---
# ipt-firewall configuration for comm.so36.net
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "192.68.11.79"
fw_ext_ips_v6:
- "2001:678:a40:3000::79"
# --- Munin
munin_remote_ipv4: 192.68.11.73
munin_remote_ipv6: "2001:678:a40:3000::73"
# --- Access control IPv4
fw_allow_ext_service_v4: "138.201.23.195:1036:tcp"
# --- Access control IPv6
fw_allow_ext_service_v6: "2a01:4f8:171:2895::195,1036,tcp"
# --- SSH
fw_ssh_ports: 1036
# --- HTTP
fw_http_server_ips: $ext_ips
# --- Mail
fw_mail_client_ips: $ext_ips
fw_dovecot_auth_port: 44444
# --- XMPP
fw_xmpp_server_ips: $ext_1_ip
fw_xmmp_remote_out_services_v4: "192.68.11.81:44444"
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/cp-01.oopen.de/cp-01-ipt-server.yml
+24
View File
@@ -0,0 +1,24 @@
---
# ipt-firewall configuration for cp-01.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "159.69.74.144"
fw_ext_ips_v6:
- "2a01:4f8:231:19a7::144"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- HTTP
fw_http_server_ips: $ext_1_ip
# --- Mail
fw_mail_client_ips: $ext_1_ip
host_vars/cp-flr.oopen.de/cp-flr-ipt-server.yml
+24
View File
@@ -0,0 +1,24 @@
---
# ipt-firewall configuration for cp-flr.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "176.9.125.39"
fw_ext_ips_v6:
- "2a01:4f8:151:8415::39"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- HTTP
fw_http_server_ips: $ext_1_ip
# --- Mail
fw_mail_client_ips: $ext_1_ip
host_vars/d.mx.oopen.de/d.mx-ipt-server.yml
+35
View File
@@ -0,0 +1,35 @@
---
# ipt-firewall configuration for d.mx.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "95.217.204.227"
fw_ext_ips_v6:
- "2a01:4f9:4a:47e5::227"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- HTTP
fw_http_server_ips: $ext_1_ip
# --- Mail
fw_smtpd_ips: $ext_1_ip
fw_mail_client_ips: $ext_1_ip
# --- Rsync
fw_rsync_out_ips: $ext_1_ip
# --- Portforwarding
fw_portforward_tcp_v4: "$ext_if_1:83.223.86.92:8443:83.223.86.117:443"
fw_portforward_tcp_v6: "$ext_if_1,2a01:30:0:13:254:9eff:fed5:e7fd,8443,2a01:30:0:13:2c5:48ff:feee:f21d,443"
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/devnull.so36.net/devnull-ipt-server.yml
+39
View File
@@ -0,0 +1,39 @@
---
# ipt-firewall configuration for devnull.so36.net
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "br0"
- "br1"
fw_ext_ips_v4:
- "83.223.73.200"
- "192.68.11.70"
fw_ext_ips_v6:
- "2a01:30:1fff:fd00::200"
- "2001:678:a40:3000::70"
# --- Munin
munin_remote_ipv4: 192.68.11.73
munin_remote_ipv6: "2001:678:a40:3000::73"
# --- Bridged / LXC
fw_do_not_firewall_bridged_traffic: true
# --- Access control IPv4
fw_allow_ext_service_v4: "138.201.23.195:1036:tcp"
# --- Access control IPv6
fw_allow_ext_service_v6: "2a01:4f8:171:2895::195,1036,tcp"
# --- SSH
fw_ssh_ports: 1036
# --- Mail
fw_dovecot_auth_port: 44444
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/dns0.warenform.de/dns0-ipt-server.yml
+25
View File
@@ -0,0 +1,25 @@
---
# ipt-firewall configuration for dns0.warenform.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "83.223.86.113"
fw_ext_ips_v6:
- "2a01:30:0:13:2fe:f9ff:fe23:24c4 2a01:30:0:505:2fe:f9ff:fe23:24c4"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- SSH
fw_ssh_server_ips: $ext_1_ip
# --- DNS
fw_dns_server_ips: $ext_1_ip
host_vars/dns1.warenform.de/dns1-ipt-server.yml
+25
View File
@@ -0,0 +1,25 @@
---
# ipt-firewall configuration for dns1.warenform.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "83.223.84.20"
fw_ext_ips_v6:
- "2a01:30:d000:6::11"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- SSH
fw_ssh_server_ips: $ext_1_ip
fw_ssh_server_ips_v6: $ext_ips
# --- DNS
fw_dns_server_ips: $ext_1_ip
host_vars/e.mx.oopen.de/e.mx-ipt-server.yml
+35
View File
@@ -0,0 +1,35 @@
---
# ipt-firewall configuration for e.mx.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "95.217.204.205"
fw_ext_ips_v6:
- "2a01:4f9:4a:47e5::205"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- HTTP
fw_http_server_ips: $ext_1_ip
# --- Mail
fw_smtpd_ips: $ext_1_ip
fw_mail_server_ips: $ext_1_ip
fw_mail_client_ips: $ext_1_ip
fw_dovecot_auth_service: true
fw_dovecot_auth_allowed_networks_v4: meet.oopen.de
fw_dovecot_auth_allowed_networks_v6: meet.oopen.de
# --- Rsync
fw_rsync_out_ips: $ext_1_ip
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/g.mx.oopen.de/g.mx-ipt-server.yml
+27
View File
@@ -0,0 +1,27 @@
---
# ipt-firewall configuration for g.mx.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "176.9.125.42"
fw_ext_ips_v6:
- "2a01:4f8:151:8415::42"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- HTTP
fw_http_server_ips: $ext_1_ip
# --- Mail
fw_smtpd_ips: $ext_1_ip
# --- Rsync
fw_rsync_out_ips: $ext_1_ip
host_vars/ga-al-gw.oopen.de/ga-al-gw-common.yml
-599
View File
@@ -1,599 +0,0 @@
---
# ---
# vars used by roles/network_interfaces
# ---
# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
network_manage_devices: true
# Should the interfaces be reloaded after config change?
network_interface_reload: false
network_interface_path: /etc/network/interfaces.d
network_interface_required_packages:
- vlan
- bridge-utils
- ifmetric
- ifupdown
- ifenslave
network_interfaces:
- device: eth0
headline: eth0 - LAN - Uplink static line (radio) to Stockausen
auto: true
family: inet
method: static
address: 172.16.111.253
netmask: 24
post-up:
# - /sbin/ip route add 172.16.211.0/24 via 172.16.111.254
# User Networks Stockhausen
- /sbin/ip route add 192.168.11.0/24 via 172.16.111.254
- /sbin/ip route add 192.168.78.0/24 via 172.16.111.254
# User Networks Campus
# - /sbin/ip route add 192.168.72.0/24 via 172.16.111.254
# - /sbin/ip route add 192.168.73.0/24 via 172.16.111.254
# User Network Novalishaus
# - /sbin/ip route add 192.168.81.0/24 via 172.16.111.254
# User Network Georgshaus
# - /sbin/ip route add 192.168.85.0/24 via 172.16.111.254
# Management Network Stockhausen
- /sbin/ip route add 10.10.11.0/24 via 172.16.111.254
# Depreated Management Network Stokhausen
- /sbin/ip route add 10.10.9.0/24 via 172.16.111.254
# IPMI Stockhausen
- /sbin/ip route add 10.11.11.0/24 via 172.16.111.254
# WLAN Gast Novalishaus
- /sbin/ip route add 10.21.0.0/20 via 172.16.111.254
# WLAN privat Novalishaus
- /sbin/ip route add 10.31.0.0/20 via 172.16.111.254
# Management Netork Campus
# - /sbin/ip route add 10.72.1.0/24 via 172.16.111.254
# WLan Router Stockhausen
- /sbin/ip route add 10.112.1.0/24 via 172.16.111.254
# WLan Netz
- /sbin/ip route add 10.113.0.0/16 via 172.16.111.254
# Unifi WLan Netz Stockhausen Gast
- /sbin/ip route add 10.121.0.0/20 via 172.16.111.254
# Unifi WLan Netz Stockhausen privat
- /sbin/ip route add 10.131.0.0/20 via 172.16.111.254
# Richtfunkantennen Stockhausen (2) / Schlechtenwegen / Kirschbaumhaus
- /sbin/ip route add 10.10.111.0/24 via 172.16.111.254
# VPN Netz Stockhausen - Novalishaus (Schlechtenwegen)
- /sbin/ip route add 10.2.81.0/24 via 172.16.111.254
# VPN Home Stockhausen
- /sbin/ip route add 10.0.11.0/24 via 172.16.111.254
# - FritzBoxen Stockhausen
- /sbin/ip route add 172.16.11.0/24 via 172.16.111.254
- /sbin/ip route add 172.16.12.0/24 via 172.16.111.254
- /sbin/ip route add 172.16.13.0/24 via 172.16.111.254
# - FritzBox Novalishaus
- /sbin/ip route add 172.16.80.0/24 via 172.16.111.254
# - DigitBox Novalishaus
- /sbin/ip route add 172.16.81.0/24 via 172.16.111.254
# - FritzBox georgshaus
- /sbin/ip route add 172.16.85.0/24 via 172.16.111.254
- device: eth1
headline: eth1 - Uplink DSL Altenschlirf via (static) line to Fritz!Box 7590
auto: true
family: inet
method: static
address: 172.16.10.1
netmask: 24
gateway: 172.16.10.254
# nameservers:
# - 192.168.10.1
# - 192.168.10.3
# search: ga.netz
- device: eth2
headline: eth2 - LAN main network Altenschlirf
auto: true
family: inet
method: static
address: 192.168.10.254
netmask: 24
post-up:
# - VLAN 221 (Ubiquiti UniFi Accesspoints)
- /sbin/ip link add link eth2 name eth2.221 type vlan id 221
- /sbin/ip link add link eth2 name eth2.231 type vlan id 231
- device: eth2:ns
headline: eth2:ns - Alias on eth2 (Nameserver)
auto: true
family: inet
method: static
address: 192.168.10.1
netmask: 32
- device: eth2:ap
headline: eth2:ap - Alias on eth2 (Network Accesspoints)
auto: true
family: inet
method: static
address: 10.122.1.254
netmask: 24
post-up:
# - Wireless Networks routed through appropriate Accesspoints
# -
- /sbin/ip route add 10.123.1.0/24 via 10.122.1.1
- /sbin/ip route add 10.123.2.0/24 via 10.122.1.2
- /sbin/ip route add 10.123.3.0/24 via 10.122.1.3
- /sbin/ip route add 10.123.4.0/24 via 10.122.1.4
- /sbin/ip route add 10.123.5.0/24 via 10.122.1.5
- /sbin/ip route add 10.123.6.0/24 via 10.122.1.6
- /sbin/ip route add 10.123.7.0/24 via 10.122.1.7
- /sbin/ip route add 10.123.8.0/24 via 10.122.1.8
- /sbin/ip route add 10.123.9.0/24 via 10.122.1.9
- /sbin/ip route add 10.123.10.0/24 via 10.122.1.10
- /sbin/ip route add 10.123.11.0/24 via 10.122.1.11
- /sbin/ip route add 10.123.12.0/24 via 10.122.1.12
- /sbin/ip route add 10.123.13.0/24 via 10.122.1.13
- /sbin/ip route add 10.123.14.0/24 via 10.122.1.14
- /sbin/ip route add 10.123.15.0/24 via 10.122.1.15
- device: eth2.221
# use only once per device (for the first device entry)
headline: eth2 - VLAN 221 (Ubiquiti UniFi Accesspoints Guest NET)
# auto & allow are only used for the first device entry
allow: [] # array of allow-[stanzas] eg. allow-hotplug
auto: true
family: inet
method: static
# hwaddress: 0c:c4:7a:7d:51:46
description:
address: 10.221.15.254
netmask: 20
gateway:
metric:
pointopoint:
mtu:
scope:
- device: eth2.231
headline: eth2 - VLAN 231 (Ubiquiti UniFi Accesspoints private NET)
auto: true
family: inet
method: static
address: 10.231.15.254
netmask: 20
# additional user by dhcp method
#
hostname:
leasehours:
leasetime:
vendor:
client:
# additional used by bootp method
#
bootfile:
server:
hwaddr:
# optional dns settings nameservers: []
#
# nameservers:
# - 194.150.168.168 # dns.as250.net
# - 91.239.100.100 # anycast.censurfridns.dk
# search: warenform.de
#
nameservers: []
# optional additional subnets/ips subnets: []
# subnets:
# - '192.168.123.0/24'
# - '192.168.124.11/32'
# optional bridge parameters bridge: {}
# bridge:
# ports:
# stp:
# fd:
# maxwait:
# waitport:
bridge: {}
# optional bonding parameters bond: {}
# bond:
# master
# primary
# slave
# method:
# miimon:
# lacp-rate:
# ad-select-rate:
# master:
# slaves:
bond: {}
# optional vlan settings | vlan: {}
# vlan: {}
# raw-device: 'eth0'
vlan: {}
# inline hook scripts
pre-up: [] # pre-up script lines
up: []
post-up: [] # post-up script lines (alias for up)
pre-down: [] # pre-down script lines (alias for down)
down: [] # down script lines
post-down: [] # post-down script lines
- device: eth4
headline: eth4 - Management Network Altenschlirf
auto: true
family: inet
method: static
address: 10.10.10.254
netmask: 24
- device: eth5
headline: eth5 - Network Telefons Altenschlirf
auto: true
family: inet
method: static
address: 172.16.210.254
netmask: 24
# ---
# vars used by roles/ansible_dependencies
# ---
# ---
# vars used by roles/ansible_user
# ---
# ---
# vars used by roles/common/tasks/basic.yml
# ---
# ---
# vars used by roles/common/tasks/sshd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
# ---
# vars used by roles/common/tasks/systemd-resolved.yml
# ---
systemd_resolved: true
# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
# Primäre DNS-Adresse: 38.132.106.139
# Sekundäre DNS-Adresse: 194.187.251.67
#
# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
# primäre DNS-Adresse
# IPv4: 1.1.1.1
# IPv6: 2606:4700:4700::1111
# sekundäre DNS-Adresse
# IPv4: 1.0.0.1
# IPv6: 2606:4700:4700::1001
#
# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
# primäre DNS-Adresse
# IPv4: 8.8.8.8
# IPv6: 2001:4860:4860::8888
# sekundäre DNS-Adresse
# IPv4: 8.8.4.4
# IPv6: 2001:4860:4860::8844
#
# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
# primäre DNS-Adresse
# IPv4: 9.9.9.9
# IPv6: 2620:fe::fe
# sekundäre DNS-Adresse
# IPv4: 149.112.112.112
# IPv6: 2620:fe::9
#
# OpenNIC - https://www.opennic.org/
# IPv4: 195.10.195.195 - ns31.de
# IPv4: 94.16.114.254 - ns28.de
# IPv4: 51.254.162.59 - ns9.de
# IPv4: 194.36.144.87 - ns29.de
# IPv6: 2a00:f826:8:2::195 - ns31.de
#
# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
# IPv4: 5.1.66.255
# IPv6: 2001:678:e68:f000::
# Servername für DNS-over-TLS: dot.ffmuc.net
# IPv4: 185.150.99.255
# IPv6: 2001:678:ed0:f000::
# Servername für DNS-over-TLS: dot.ffmuc.net
# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
# Note: systemd-resolved uses 'FallbackDNS' only if no 'DNS' is configured at all. So
# the other (internal) nameserver gateways are listed here as additional DNS servers.
resolved_nameserver:
- 127.0.0.1
- 192.168.11.1
- 192.168.81.1
# search domains
#
# If there are more than one search domains, then specify them here in the order in which
# the resolver should also search them
#
# resolved_domains: []
resolved_domains:
- ~.
- ga.netz
- ga.intra
resolved_dnssec: false
# dns.as250.net: 194.150.168.168
#
resolved_fallback_nameserver:
- 192.168.11.1
- 192.168.81.1
# ---
# vars used by roles/common/tasks/cron.yml
# ---
cron_user_entries:
- name: "Check forwarding ( /proc/sys/net/ipv4/ip_forward contains \"1\" )"
minute: '0-59/3'
hour: '*'
job: /root/bin/monitoring/check_forwarding.sh
- name: "Check if nameservice (bind) is running?"
minute: '*/23'
hour: '*'
job: /root/bin/monitoring/check_dns.sh
- name: "Check if Resolver (systemd-resolved) is up and running?"
minute: '*/23'
hour: '*'
job: bin/monitoring/check_systemd_resolved.sh
- name: "Check if Postfix Mailservice is up and running?"
minute: '*/17'
hour: '*'
job: /root/bin/monitoring/check_postfix.sh
- name: "Check if SSH service is up and running?"
minute: '*/13'
hour: '*'
job: /root/bin/monitoring/check_ssh.sh
- name: "Check if OpenVPN service is up and running?"
minute: '*/29'
hour: '*'
job: /root/bin/monitoring/check_vpn.sh
- name: "Copy gateway configuration"
minute: '09'
hour: '3'
job: /root/bin/manage-gw-config/copy_gateway-config.sh GA-AL
- name: "Speedtest"
minute: 13
hour: 0-8
job: /root/bin/admin-stuff/speedtest.sh
cron_user_special_time_entries:
- name: "Restart NTP service 'ntpsec'"
special_time: reboot
job: "sleep 15 ; /bin/systemctl restart ntpsec"
insertafter: PATH
# ---
# vars used by roles/common/tasks/users.yml
# ---
insert_ssh_keypair_backup_server: false
ssh_keypair_backup_server:
- name: backup
backup_user: back
priv_key_src: root/.ssh/id_rsa.backup.oopen.de
priv_key_dest: /root/.ssh/id_rsa
pub_key_src: root/.ssh/id_rsa.backup.oopen.de.pub
pub_key_dest: /root/.ssh/id_rsa.pub
insert_keypair_backup_client: true
ssh_keypair_backup_client:
- name: backup
priv_key_src: root/.ssh/id_ed25519.oopen-server
priv_key_dest: /root/.ssh/id_ed25519
pub_key_src: root/.ssh/id_ed25519.oopen-server.pub
pub_key_dest: /root/.ssh/id_ed25519.pub
target: backup.oopen.de
default_user:
- name: chris
password: $y$j9T$rDrvWa/KInzTe601YYf9./$WjDlaItCrgX7gu4nCs481y8WLxiRaNJCC/MgFgKuzg3
shell: /bin/bash
ssh_keys:
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
- name: maadmin
password: $y$j9T$LCkYWvykWzrpFxIlmSUB01$e1ROfZxXAU53UdAwZAECzED4iV4LS02Q4IPQ2fycv51
shell: /bin/bash
ssh_keys:
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHCQRRXy0+9D+mhLniRlUpZZ3kZdZcQKXBsGnlsFYaRi maadmin@ga-st-lsx1'
- name: wadmin
password: $6$sLWIXKTW$i/STlSS0LijkrnGR/XMbaxJsEbrRdDYgqyCqIr.muLN5towes8yHDCXsyCYDjuaBNKPHXyFpr8lclg5DOm9OF1
shell: /bin/bash
ssh_keys:
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
- name: sysadm
user_id: 1050
group_id: 1050
group: sysadm
password: $y$j9T$awYUu9oRvV39ojITZOC7D1$czTh5HHIE32PXb0vl40ayAarm39txR4jaH1QzBscqfC
shell: /bin/bash
ssh_keys:
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHCQRRXy0+9D+mhLniRlUpZZ3kZdZcQKXBsGnlsFYaRi maadmin@ga-st-lsx1'
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
- name: back
user_id: 1060
group_id: 1060
group: back
password: $y$j9T$wpg8hlvMpO4PAWSVdLoJq/$dgpQh4cEnbUOQkkZzKUM4S8XzNS/Md5gMmMuNTqec74
shell: /bin/bash
ssh_keys:
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
sudo_users:
- chris
- sysadm
- maadmin
- wadmin
# ---
# vars used by roles/common/tasks/users-systemfiles.yml
# ---
# ---
# vars used by roles/common/tasks/webadmin-user.yml
# ---
# ---
# vars used by roles/common/tasks/sudoers.yml
# ---
#
# see: roles/common/tasks/vars
# ---
# vars used by roles/common/tasks/caching-nameserver.yml
# ---
install_bind_packages: true
bind9_gateway_acl:
- local-net:
name: local-net
entries:
- 127.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 10.0.0.0/8
- fc00::/7
- fe80::/10
- ::1/128
- internaldns:
name: internaldns
entries:
- '# Nameserver Gateway Stockhausen'
- 192.168.11.1
- '# Domain Controller Stockhausen'
- 192.168.11.3
- '# Nameserver Gateway Altenschlirf'
- 192.168.10.1
- '# Domain Controller Altenschlirf'
- 192.168.10.3
- 192.168.10.6
- 172.16.0.1
- '# Nameserver Gateway Novalishaus'
- 192.168.81.1
- 10.2.11.2
- '# Nameserver Gateway Georgshaus'
- 192.168.85.1
- '# Nameserver wolle'
- 10.113.12.3
- '# Postfix Mailserver'
- 192.168.11.2
- '# Mail Relay System'
- 192.168.10.2
bind9_gateway_listen_on_v6:
- none
bind9_gateway_listen_on:
- any
# bind9_gateway_allow_transfer: {}
bind9_gateway_allow_transfer:
- none
bind9_transfer_source: !!str "192.168.10.1"
bind9_notify_source: !!str "192.168.10.1"
# bind9_gateway_allow_query: {}
bind9_gateway_allow_query:
- local-net
# bind9_gateway_allow_query_cache: {}
bind9_gateway_allow_query_cache:
- local-net
bind9_gateway_recursion: !!str "yes"
# bind9_gateway_allow_recursion: {}
bind9_gateway_allow_recursion:
- local-net
# ---
# vars used by roles/common/tasks/git.yml
# ---
git_firewall_repository:
name: ipt-gateway
repo: https://git.oopen.de/firewall/ipt-gateway
dest: /usr/local/src/ipt-gateway
git_other_repositories:
- name: check_net
repo: https://git.oopen.de/routing/check_net
dest: /usr/local/src/check_net
- name: borg2-binaries
repo: https://git.oopen.de/backup/borg2-binaries
dest: /usr/local/src/borg2-binaries
# ==============================
# ---
# vars used by scripts/reset_root_passwd.yml
# ---
root_user:
name: root
password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
host_vars/ga-al-gw-neu.ga.netz/ga-al-gw-neu-common.yml → host_vars/ga-al-gw.oopen.de/ga-al-gw-neu-common.yml
+21 -21
View File
@@ -20,8 +20,8 @@ network_interface_required_packages:
network_interfaces:
- device: enp1s0f0
headline: enp1s0f0 - LAN - Uplink static line (radio) to Stockausen
- device: lan2
headline: lan2 - LAN - Uplink static line (radio) to Stockausen
auto: true
family: inet
method: static
@@ -80,8 +80,8 @@ network_interfaces:
- /sbin/ip route add 172.16.85.0/24 via 172.16.111.254
- device: enp6s0f0
headline: enp6s0f0 - Uplink DSL Altenschlirf via (static) line to Fritz!Box 7590
- device: lan0
headline: lan0 - Uplink DSL Altenschlirf via (static) line to Fritz!Box 7590
auto: true
family: inet
method: static
@@ -94,8 +94,8 @@ network_interfaces:
# search: ga.netz
- device: enp6s0f1
headline: enp6s0f1 - LAN main network Altenschlirf
- device: lan1
headline: lan1 - LAN main network Altenschlirf
auto: true
family: inet
method: static
@@ -103,19 +103,19 @@ network_interfaces:
netmask: 24
post-up:
# - VLAN 221 (Ubiquiti UniFi Accesspoints)
- /sbin/ip link add link enp6s0f1 name enp6s0f1.221 type vlan id 221
- /sbin/ip link add link enp6s0f1 name enp6s0f1.231 type vlan id 231
- /sbin/ip link add link lan1 name lan1.221 type vlan id 221
- /sbin/ip link add link lan1 name lan1.231 type vlan id 231
- device: enp6s0f1:ns
headline: enp6s0f1:ns - Alias on enp6s0f1 (Nameserver)
- device: lan1:ns
headline: lan1:ns - Alias on lan1 (Nameserver)
auto: true
family: inet
method: static
address: 192.168.10.1
netmask: 32
- device: enp6s0f1:ap
headline: enp6s0f1:ap - Alias on enp6s0f1 (Network Accesspoints)
- device: lan1:ap
headline: lan1:ap - Alias on lan1 (Network Accesspoints)
auto: true
family: inet
method: static
@@ -140,9 +140,9 @@ network_interfaces:
- /sbin/ip route add 10.123.14.0/24 via 10.122.1.14
- /sbin/ip route add 10.123.15.0/24 via 10.122.1.15
- device: enp6s0f1.221
- device: lan1.221
# use only once per device (for the first device entry)
headline: enp6s0f1 - VLAN 221 (Ubiquiti UniFi Accesspoints Guest NET)
headline: lan1 - VLAN 221 (Ubiquiti UniFi Accesspoints Guest NET)
# auto & allow are only used for the first device entry
allow: [] # array of allow-[stanzas] eg. allow-hotplug
@@ -160,8 +160,8 @@ network_interfaces:
mtu:
scope:
- device: enp6s0f1.231
headline: enp6s0f1 - VLAN 231 (Ubiquiti UniFi Accesspoints private NET)
- device: lan1.231
headline: lan1 - VLAN 231 (Ubiquiti UniFi Accesspoints private NET)
auto: true
family: inet
method: static
@@ -220,7 +220,7 @@ network_interfaces:
# optional vlan settings | vlan: {}
# vlan: {}
# raw-device: 'enp1s0f0'
# raw-device: 'lan2'
vlan: {}
# inline hook scripts
@@ -232,8 +232,8 @@ network_interfaces:
post-down: [] # post-down script lines
- device: enp1s0f2
headline: enp1s0f2 - Management Network Altenschlirf
- device: lan4
headline: lan4 - Management Network Altenschlirf
auto: true
family: inet
method: static
@@ -241,8 +241,8 @@ network_interfaces:
netmask: 24
- device: enp1s0f3
headline: enp1s0f3 - Network Telefons Altenschlirf
- device: lan5
headline: lan5 - Network Telefons Altenschlirf
auto: true
family: inet
method: static
host_vars/git.oopen.de/git-ipt-server.yml
+24
View File
@@ -0,0 +1,24 @@
---
# ipt-firewall configuration for git.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "37.27.121.221"
fw_ext_ips_v6:
- "2a01:4f9:3070:2bda::221"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- HTTP
fw_http_server_ips: $ext_ips
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/git.warenform.de/git-ipt-server.yml
+29
View File
@@ -0,0 +1,29 @@
---
# ipt-firewall configuration for git.warenform.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "78.46.47.82"
fw_ext_ips_v6:
- "2a01:4f8:110:401b::82"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- HTTP
fw_http_server_ips: $ext_ips
# --- Mail
fw_mail_server_ips_v6: $ext_ips
fw_mail_client_ips: $ext_ips
fw_mail_client_ips_v6: ""
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/gw-opp-neu.opp.netz/gw-opp-neu-common.yml
-235
View File
@@ -1,235 +0,0 @@
---
# ---
# vars used by roles/network_interfaces
# ---
# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
network_manage_devices: true
# Should the interfaces be reloaded after config change?
network_interface_reload: false
network_interface_path: /etc/network/interfaces.d
network_interface_required_packages:
- vlan
- bridge-utils
- ifmetric
- ifupdown
- ifenslave
network_interfaces:
- device: eno1
headline: eno1 - Uplink DSL via Fritz!Box
auto: true
family: inet
method: static
address: 172.16.62.2
netmask: 24
gateway: 172.16.62.254
# nameservers:
# - 127.0.0.1
# - 192.168.62.1
# search: ebs.netz kanzlei-kiel.netz elster.netz
- device: eno2
headline: eno2 - LAN
auto: true
family: inet
method: static
address: 192.168.62.253
netmask: 24
- device: eno3:ns
headline: eno2:ns - Alias on eno2 (Nameserver)
auto: true
family: inet
method: static
address: 192.168.62.1
netmask: 32
# ---
# vars used by roles/ansible_dependencies
# ---
# ---
# vars used by roles/ansible_user
# ---
# ---
# vars used by roles/common/tasks/basic.yml
# ---
# ---
# vars used by roles/common/tasks/sshd.yml
# ---
sshd_hostkeyalgorithms:
- ssh-ed25519
- ssh-ed25519-cert-v01@openssh.com
- rsa-sha2-256
- rsa-sha2-512
- ecdsa-sha2-nistp256
- rsa-sha2-256-cert-v01@openssh.com
- rsa-sha2-512-cert-v01@openssh.com
# ---
# vars used by roles/common/tasks/apt.yml
# ---
# ---
# vars used by roles/common/tasks/systemd-resolved.yml
# ---
systemd_resolved: true
# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
# Primäre DNS-Adresse: 38.132.106.139
# Sekundäre DNS-Adresse: 194.187.251.67
#
# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
# primäre DNS-Adresse
# IPv4: 1.1.1.1
# IPv6: 2606:4700:4700::1111
# sekundäre DNS-Adresse
# IPv4: 1.0.0.1
# IPv6: 2606:4700:4700::1001
#
# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
# primäre DNS-Adresse
# IPv4: 8.8.8.8
# IPv6: 2001:4860:4860::8888
# sekundäre DNS-Adresse
# IPv4: 8.8.4.4
# IPv6: 2001:4860:4860::8844
#
# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
# primäre DNS-Adresse
# IPv4: 9.9.9.9
# IPv6: 2620:fe::fe
# sekundäre DNS-Adresse
# IPv4: 149.112.112.112
# IPv6: 2620:fe::9
#
# OpenNIC - https://www.opennic.org/
# IPv4: 195.10.195.195 - ns31.de
# IPv4: 94.16.114.254 - ns28.de
# IPv4: 51.254.162.59 - ns9.de
# IPv4: 194.36.144.87 - ns29.de
# IPv6: 2a00:f826:8:2::195 - ns31.de
#
# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
# IPv4: 5.1.66.255
# IPv6: 2001:678:e68:f000::
# Servername für DNS-over-TLS: dot.ffmuc.net
# IPv4: 185.150.99.255
# IPv6: 2001:678:ed0:f000::
# Servername für DNS-over-TLS: dot.ffmuc.net
# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
resolved_nameserver:
- 127.0.0.1
# search domains
#
# If there are more than one search domains, then specify them here in the order in which
# the resolver should also search them
#
# resolved_domains: []
resolved_domains:
- ~.
- opp.netz
resolved_dnssec: false
# dns.as250.net: 194.150.168.168
#
resolved_fallback_nameserver:
- 194.150.168.168
# ---
# vars used by roles/common/tasks/cron.yml
# ---
cron_user_special_time_entries:
- name: "Restart NTP service 'ntpsec'"
special_time: reboot
job: "sleep 15 ; /bin/systemctl restart ntpsec"
insertafter: PATH
# ---
# vars used by roles/common/tasks/users.yml
# ---
insert_ssh_keypair_backup_server: false
ssh_keypair_backup_server:
- name: backup
backup_user: back
priv_key_src: root/.ssh/id_rsa.backup.oopen.de
priv_key_dest: /root/.ssh/id_rsa
pub_key_src: root/.ssh/id_rsa.backup.oopen.de.pub
pub_key_dest: /root/.ssh/id_rsa.pub
insert_keypair_backup_client: true
ssh_keypair_backup_client:
- name: backup
priv_key_src: root/.ssh/id_ed25519.oopen-server
priv_key_dest: /root/.ssh/id_ed25519
pub_key_src: root/.ssh/id_ed25519.oopen-server.pub
pub_key_dest: /root/.ssh/id_ed25519.pub
target: backup.oopen.de
# ---
# vars used by roles/common/tasks/users-systemfiles.yml
# ---
# ---
# vars used by roles/common/tasks/webadmin-user.yml
# ---
# ---
# vars used by roles/common/tasks/sudoers.yml
# ---
#
# see: roles/common/tasks/vars
# ---
# vars used by roles/common/tasks/caching-nameserver.yml
# ---
install_bind_packages: true
# ---
# vars used by roles/common/tasks/git.yml
# ---
git_firewall_repository:
name: ipt-gateway
repo: https://git.oopen.de/firewall/ipt-gateway
dest: /usr/local/src/ipt-gateway
# ==============================
# ---
# vars used by scripts/reset_root_passwd.yml
# ---
root_user:
name: root
password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
host_vars/iam-nd.oopen.de/iam-nd-ipt-server.yml
+24
View File
@@ -0,0 +1,24 @@
---
# ipt-firewall configuration for iam-nd.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "176.9.62.67"
fw_ext_ips_v6:
- "2a01:4f8:150:805b::67"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- HTTP
fw_http_server_ips: $ext_1_ip
# --- Mail
fw_mail_client_ips: $ext_1_ip
host_vars/initiativenserver.oopen.de/initiativenserver-ipt-server.yml
+30
View File
@@ -0,0 +1,30 @@
---
# ipt-firewall configuration for initiativenserver.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "83.223.86.118"
fw_ext_ips_v6:
- "2a01:30:0:505:2c7:5bff:fe44:bd50 2a01:30:0:13:2c7:5bff:fe44:bd50"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- HTTP
fw_http_server_ips: $ext_1_ip
fw_http_server_ips_v6: $ext_ips
# --- Mail
fw_mail_client_ips: $ext_1_ip
fw_mail_client_ips_v6: $ext_ips
# --- FTP
fw_ftp_server_ips: $ext_1_ip
fw_ftp_server_ips_v6: $ext_ips
host_vars/keycloak-nd.oopen.de/keycloak-nd-ipt-server.yml
+30
View File
@@ -0,0 +1,30 @@
---
# ipt-firewall configuration for keycloak-nd.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "176.9.62.94"
fw_ext_ips_v6:
- "2a01:4f8:150:805b::94"
fw_local_interfaces:
- "eth1"
fw_local_interfaces_v6: []
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Access control IPv4
fw_allow_ext_service_v4: "49.13.0.25:3890:tcp"
# --- HTTP
fw_http_server_ips: $ext_1_ip
# --- Mail
fw_mail_client_ips: $ext_1_ip
host_vars/ki-fm.oopen.de/ki-fm-common.yml
-180
View File
@@ -1,180 +0,0 @@
---
# ---
# vars used by roles/ansible_dependencies
# ---
# ---
# vars used by roles/ansible_user
# ---
# ---
# vars used by roles/common/tasks/basic.yml
# ---
# ---
# vars used by roles/common/tasks/sshd.yml
# ---
sshd_permit_root_login: !!str "prohibit-password"
# ---
# vars used by apt.yml
# ---
apt_install_extra_pkgs: true
apt_extra_pkgs:
- python3
- python3-venv
- python3-pip
- build-essential
- libxml2-dev
- libxslt1-dev
# ---
# vars used by roles/common/tasks/systemd-resolved.yml
# ---
systemd_resolved: true
# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
# Primäre DNS-Adresse: 38.132.106.139
# Sekundäre DNS-Adresse: 194.187.251.67
#
# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
# primäre DNS-Adresse
# IPv4: 1.1.1.1
# IPv6: 2606:4700:4700::1111
# sekundäre DNS-Adresse
# IPv4: 1.0.0.1
# IPv6: 2606:4700:4700::1001
#
# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
# primäre DNS-Adresse
# IPv4: 8.8.8.8
# IPv6: 2001:4860:4860::8888
# sekundäre DNS-Adresse
# IPv4: 8.8.4.4
# IPv6: 2001:4860:4860::8844
#
# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
# primäre DNS-Adresse
# IPv4: 9.9.9.9
# IPv6: 2620:fe::fe
# sekundäre DNS-Adresse
# IPv4: 149.112.112.112
# IPv6: 2620:fe::9
#
# OpenNIC - https://www.opennic.org/
# IPv4: 195.10.195.195 - ns31.de
# IPv4: 94.16.114.254 - ns28.de
# IPv4: 51.254.162.59 - ns9.de
# IPv4: 194.36.144.87 - ns29.de
# IPv6: 2a00:f826:8:2::195 - ns31.de
#
# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
# IPv4: 5.1.66.255
# IPv6: 2001:678:e68:f000::
# Servername für DNS-over-TLS: dot.ffmuc.net
# IPv4: 185.150.99.255
# IPv6: 2001:678:ed0:f000::
# Servername für DNS-over-TLS: dot.ffmuc.net
# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
resolved_nameserver:
- 185.12.64.2
- 185.12.64.1
- 2a01:4ff:ff00::add:2
- 2a01:4ff:ff00::add:1
# search domains
#
# If there are more than one search domains, then specify them here in the order in which
# the resolver should also search them
#
# resolved_domains: []
resolved_domains:
- ~.
- oopen.de
resolved_dnssec: false
# dns.as250.net: 194.150.168.168
#
resolved_fallback_nameserver:
- 194.150.168.168
# ---
# vars used by roles/common/tasks/cron.yml
# ---
cron_env_entries:
- name: PATH
job: /root/bin/admin-stuff:/root/bin:/usr/local/apache2/bin:/usr/local/php/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
- name: SHELL
job: /bin/bash
insertafter: PATH
cron_user_special_time_entries:
- name: "Restart DNS Cache service 'systemd-resolved'"
special_time: reboot
job: "sleep 5 ; /bin/systemctl restart systemd-resolved"
insertafter: PATH
# ---
# vars used by roles/common/tasks/users.yml
# ---
sudo_users:
- chris
- sysadm
- localadmin
# ---
# vars used by roles/common/tasks/users-systemfiles.yml
# ---
# ---
# vars used by roles/common/tasks/webadmin-user.yml
# ---
# ---
# vars used by roles/common/tasks/sudoers.yml
# ---
#
# see: roles/common/tasks/vars
sudoers_file_user_privileges:
- name: back
entry: 'ALL=(www-data) NOPASSWD: /usr/local/php/bin/php'
# ---
# vars used by roles/common/tasks/caching-nameserver.yml
# ---
# ---
# vars used by roles/common/tasks/git.yml
# ---
#
# see: roles/common/tasks/vars
# ==============================
# ---
# vars used by scripts/reset_root_passwd.yml
# ---
host_vars/lists.mx.warenform.de/lists.mx-ipt-server.yml
+37
View File
@@ -0,0 +1,37 @@
---
# ipt-firewall configuration for lists.mx.warenform.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
- "eth1"
fw_ext_ips_v4:
- "83.223.86.78"
- "83.223.86.77"
fw_ext_ips_v6:
- "2a01:30:0:13:223:35ff:fef5:84b6 2a01:30:0:505:223:35ff:fef5:84b6"
- "2a01:30:0:13:26e:a5ff:fe01:1bd8 2a01:30:0:505:26e:a5ff:fe01:1bd8"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- HTTP
fw_http_server_ips: $ext_1_ip
# --- Mail
fw_smtpd_ips: $ext_1_ip
# --- Rsync
fw_rsync_out_ips: $ext_1_ip
# --- Portforwarding
fw_portforward_tcp_v4: "$ext_if_2:83.223.86.77:80:83.223.86.76:80 $ext_if_2:83.223.86.77:443:83.223.86.76:443"
fw_portforward_tcp_v6: "$ext_if_2,2a01:30:0:13:26e:a5ff:fe01:1bd8,80,2a01:30:0:13:231:32ff:fe8b:7763,80 $ext_if_2,2a01:30:0:13:26e:a5ff:fe01:1bd8,443,2a01:30:0:13:231:32ff:fe8b:7763,443"
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/mail-neu.cadus.org/mail-neu-common.yml
-241
View File
@@ -1,241 +0,0 @@
---
# ---
# vars used by roles/ansible_dependencies
# ---
# ---
# vars used by roles/ansible_user
# ---
# ---
# vars used by roles/common/tasks/basic.yml
# ---
# ---
# vars used by roles/common/tasks/sshd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
install_compiler_pkgs: true
install_postgresql_pkgs: false
# ---
# vars used by roles/common/tasks/users.yml
# ---
insert_root_ssh_keypair: true
root_ssh_keypair:
- name: id-rsa-dehydrated
priv_key_src: mail.cadus/root/.ssh/mail.cadus-id_rsa-dehydrated
priv_key_dest: /root/.ssh/id_rsa-dehydrated
pub_key_src: mail.cadus/root/.ssh/mail.cadus-id_rsa-dehydrated.pub
pub_key_dest: /root/.ssh/id_rsa-dehydrated.pub
- name: id-rsa-opendkim
priv_key_src: mail.cadus/root/.ssh/mail.cadus-id_rsa-opendkim
priv_key_dest: /root/.ssh/id_rsa-opendkim
pub_key_src: mail.cadus/root/.ssh/mail.cadus-id_rsa-opendkim.pub
pub_key_dest: /root/.ssh/id_rsa-opendkim.pub
# ---
# vars used by roles/common/tasks/users-systemfiles.yml
# ---
# ---
# vars used by roles/common/tasks/webadmin-user.yml
# ---
# ---
# vars used by roles/common/tasks/sudoers.yml
# ---
#
# see: roles/common/tasks/vars
# ---
# vars used by roles/common/tasks/caching-nameserver.yml
# ---
# ---
# vars used by roles/common/tasks/git.yml
# ---
#
# see: roles/common/tasks/vars
# ---
# vars used by roles/common/tasks/copy_files.yml
# ---
copy_plain_files:
# /root/bin/monitoring
#
- name: monitoring_check_cert_for_dovecot.conf
src_path: mail.cadus/root/bin/monitoring/conf/check_cert_for_dovecot.conf
dest_path: /root/bin/monitoring/conf/check_cert_for_dovecot.conf
# /root/bin/postfix
#
- name: postfix_create_opendkim_key.conf
src_path: mail.cadus/root/bin/postfix/conf/create_opendkim_key.conf
dest_path: /root/bin/postfix/conf/create_opendkim_key.conf
- name: postfix_postfix_add_mailboxes.conf
src_path: mail.cadus/root/bin/postfix/conf/postfix_add_mailboxes.conf
dest_path: /root/bin/postfix/conf/postfix_add_mailboxes.conf
- name: postfix_sent_userinfo_postfix.conf
src_path: mail.cadus/root/bin/postfix/conf/sent_userinfo_postfix.conf
dest_path: /root/bin/postfix/conf/sent_userinfo_postfix.conf
- name: postfix_whitelist_mb_sigs.conf
src_path: mail.cadus/root/bin/postfix/conf/whitelist_mb_sigs.conf
dest_path: /root/bin/postfix/conf/whitelist_mb_sigs.conf
copy_plain_files_postfwd_host_specific:
- name: postfwd.wl-hosts
src_path: mail.cadus/etc/postfix/postfwd.wl-hosts
dest_path: /etc/postfix/postfwd.wl-hosts
- name: postfwd.wl-nets
src_path: mail.cadus/etc/postfix/postfwd.wl-nets
dest_path: /etc/postfix/postfwd.wl-nets
- name: postfwd.wl-sender
src_path: mail.cadus/etc/postfix/postfwd.wl-sender
dest_path: /etc/postfix/postfwd.wl-sender
- name: postfwd.wl-user
src_path: mail.cadus/etc/postfix/postfwd.wl-user
dest_path: /etc/postfix/postfwd.wl-user
# Postfix Firewall postfwd
#
# - name: postfwd.wl-user
# src_path: mail.cadus/etc/postfix/postfwd.wl-user
# dest_path: /etc/postfix/postfwd.wl-user
# copy_template_files: []
#
# - name: mailsystem_install_amavis.conf
# src_path: usr/local/src/mailsystem/conf/install_amavis.conf.j2
# dest_path: /usr/local/src/mailsystem/conf/install_amavis.conf
# ---
# vars used by roles/common/tasks/config_files_mailsystem_scripts.yml
# ---
hostname: mail.cadus.org
ipv4_address: 135.181.22.161
ipv6_address: 2a01:4f9:4b:46d1::161
admin_email: it@cadus.org
is_relay_host: !!str "false"
db_in_use: !!str "true"
# postfix_db_type
#
# possible values are 'PostgreSQL' and 'MySQL'
postfix_db_type: MySQL
postfix_db_name: postfix
postfix_db_user: postfix
# postfix_db_host:
postfix_db_pass: T3CJnFMJNX9wmhNs
mysql_credentials: !!str "-u root -S /run/mysqld/mysqld.sock"
# install_amavis.conf
#
mp_receipt_number: 106015125438
si_authorisation_signature: abb4ec6b194639f3d123154f1b971843a3b8751d8c1bcdc7d07ed6db26621b11bca0e23d2a42b60aef3f7b7803a1466a964d90c7b1e82d67c7680c8f46b59a4e
# install_postfixadmin.conf
#
website_name_postfixadmin: adm.cadus.org
email_welcome_message: "\n
Hallo,\n
Ihre/Deine neue E-Mail Adresse ist eingerichtet.\n
Cadus e.V. - Redefine Global Solidarity\n
--\n
Cadus e.V.\n
Am Sudhaus 2\n
D-12053 Berlin\n
admin@cadus.org\n
"
# install_update_dovecot.conf
#
dovecot_from_address: "Administrator E-Mail <admin@cadus.org>"
dovecot_reply_to: "admin@cadus.org"
webmailer_address: "https://webmail.cadus.org"
salutation: "Cadus e.V. - Redefine Global Solidarity\n
--\n
Cadus e.V.\n
Am Sudhaus 2\n
D-12053 Berlin\n
admin@cadus.org\n
"
# install_upgrade_roundcube-webmail.conf
#
# Webmailer
webmail_site_name: webmail.cadus.org
autoreply_hostname: autoreply.cadus.org
# possible values: 'pgsql' or 'mysql'
roundcube_db_type: mysql
roundcube_db_name: roundcubemail
roundcube_db_user: roundcube
# roundcube_db_host:
roundcube_db_pass: 'j3vqsK7Ldm7MxNjH'
roundcube_acl_plugin: false
roundcube_product_name: O.OPEN - Webmailer
roundcube_support_url: https://www.cadus.org
roundcube_skin_logo: "images/cadu_logo_webmail.png"
template_files_mailsystem_script:
- name: mailsystem_install_amavis.conf
src_path: usr/local/src/mailsystem/conf/install_amavis.conf.j2
dest_path: /usr/local/src/mailsystem/conf/install_amavis.conf
- name: mailsystem_install_postfixadmin.conf
src_path: usr/local/src/mailsystem/conf/install_postfix_advanced.conf.j2
dest_path: /usr/local/src/mailsystem/conf/install_postfix_advanced.conf
- name: mailsystem_install_postfixadmin.conf
src_path: usr/local/src/mailsystem/conf/install_postfixadmin.conf.j2
dest_path: /usr/local/src/mailsystem/conf/install_postfixadmin.conf
- name: mailsystem_install_update_dovecot.conf
src_path: usr/local/src/mailsystem/conf/install_update_dovecot.conf.j2
dest_path: /usr/local/src/mailsystem/conf/install_update_dovecot.conf
- name: mailsystem_install_upgrade_roundcube-webmail.conf
src_path: usr/local/src/mailsystem/conf/install_upgrade_roundcube-webmail.conf.j2
dest_path: /usr/local/src/mailsystem/conf/install_upgrade_roundcube-webmail.conf
host_vars/mail.cadus.org/mail-ipt-server.yml
+32
View File
@@ -0,0 +1,32 @@
---
# ipt-firewall configuration for mail.cadus.org
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "135.181.22.161"
fw_ext_ips_v6:
- "2a01:4f9:4b:46d1::161"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- HTTP
fw_http_server_ips: $ext_1_ip
# --- Mail
fw_smtpd_ips: $ext_1_ip
fw_mail_server_ips: $ext_1_ip
fw_mail_client_ips: $ext_1_ip
# --- Rsync
fw_rsync_out_ips: $ext_1_ip
# --- Protection / limits
fw_limit_connections_per_source_IP: false
host_vars/mail.faire-mobilitaet.de/mail-ipt-server.yml
+32
View File
@@ -0,0 +1,32 @@
---
# ipt-firewall configuration for mail.faire-mobilitaet.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "142.132.147.169"
fw_ext_ips_v6:
- "2a01:4f8:261:1994::169"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- HTTP
fw_http_server_ips: $ext_1_ip
# --- Mail
fw_smtpd_ips: $ext_1_ip
fw_mail_server_ips: $ext_1_ip
fw_mail_client_ips: $ext_1_ip
# --- Rsync
fw_rsync_out_ips: $ext_1_ip
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/matomo-01.oopen.de/matomo-01-ipt-server.yml
+27
View File
@@ -0,0 +1,27 @@
---
# ipt-firewall configuration for matomo-01.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "162.55.82.77"
fw_ext_ips_v6:
- "2a01:4f8:271:1266::77"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- HTTP
fw_http_server_ips: $ext_1_ip
# --- Mail
fw_mail_client_ips: $ext_1_ip
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/meet.akweb.de/meet-ipt-server.yml
+32
View File
@@ -0,0 +1,32 @@
---
# ipt-firewall configuration for meet.akweb.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "148.251.14.136"
fw_ext_ips_v6:
- "2a01:4f8:201:7389::136"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- HTTP
fw_http_server_ips: $ext_1_ip
# --- Mail
fw_mail_client_ips: $ext_1_ip
# --- Jitsi
fw_jitsi_server_ips: $ext_1_ip
fw_jitsi_dovecot_auth: true
fw_jitsi_dovecot_host: a.mx.oopen.de
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/meet.oopen.de/meet-ipt-server.yml
+29
View File
@@ -0,0 +1,29 @@
---
# ipt-firewall configuration for meet.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "159.69.74.155"
fw_ext_ips_v6:
- "2a01:4f8:231:19a7::155"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- HTTP
fw_http_server_ips: $ext_1_ip
# --- Mail
fw_mail_client_ips: $ext_1_ip
# --- Jitsi
fw_jitsi_server_ips: $ext_1_ip
fw_jitsi_dovecot_auth: true
fw_jitsi_dovecot_host: a.mx.oopen.de
host_vars/mm-migration.oopen.de/mm-migration-common.yml
-140
View File
@@ -1,140 +0,0 @@
---
# ---
# vars used by roles/ansible_dependencies
# ---
# ---
# vars used by roles/ansible_user
# ---
# ---
# vars used by roles/common/tasks/basic.yml
# ---
# ---
# vars used by roles/common/tasks/sshd.yml
# ---
sshd_permit_root_login: !!str "prohibit-password"
# ---
# vars used by apt.yml
# ---
# ---
# vars used by roles/common/tasks/systemd-resolved.yml
# ---
systemd_resolved: true
# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
# Primäre DNS-Adresse: 38.132.106.139
# Sekundäre DNS-Adresse: 194.187.251.67
#
# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
# primäre DNS-Adresse
# IPv4: 1.1.1.1
# IPv6: 2606:4700:4700::1111
# sekundäre DNS-Adresse
# IPv4: 1.0.0.1
# IPv6: 2606:4700:4700::1001
#
# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
# primäre DNS-Adresse
# IPv4: 8.8.8.8
# IPv6: 2001:4860:4860::8888
# sekundäre DNS-Adresse
# IPv4: 8.8.4.4
# IPv6: 2001:4860:4860::8844
#
# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
# primäre DNS-Adresse
# IPv4: 9.9.9.9
# IPv6: 2620:fe::fe
# sekundäre DNS-Adresse
# IPv4: 149.112.112.112
# IPv6: 2620:fe::9
#
# OpenNIC - https://www.opennic.org/
# IPv4: 195.10.195.195 - ns31.de
# IPv4: 94.16.114.254 - ns28.de
# IPv4: 51.254.162.59 - ns9.de
# IPv4: 194.36.144.87 - ns29.de
# IPv6: 2a00:f826:8:2::195 - ns31.de
#
# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
# IPv4: 5.1.66.255
# IPv6: 2001:678:e68:f000::
# Servername für DNS-over-TLS: dot.ffmuc.net
# IPv4: 185.150.99.255
# IPv6: 2001:678:ed0:f000::
# Servername für DNS-over-TLS: dot.ffmuc.net
# für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
resolved_nameserver:
- 185.12.64.1
- 2a01:4ff:ff00::add:2
- 195.201.179.131
- 95.217.204.204
# search domains
#
# If there are more than one search domains, then specify them here in the order in which
# the resolver should also search them
#
# resolved_domains: []
resolved_domains:
- oopen.de
resolved_dnssec: false
# dns.as250.net: 194.150.168.168
#
resolved_fallback_nameserver:
- 194.150.168.168
# ---
# vars used by roles/common/tasks/users.yml
# ---
# ---
# vars used by roles/common/tasks/users-systemfiles.yml
# ---
# ---
# vars used by roles/common/tasks/webadmin-user.yml
# ---
# ---
# vars used by roles/common/tasks/sudoers.yml
# ---
#
# see: roles/common/tasks/vars
# ---
# vars used by roles/common/tasks/caching-nameserver.yml
# ---
# ---
# vars used by roles/common/tasks/git.yml
# ---
#
# see: roles/common/tasks/vars
# ==============================
# ---
# vars used by scripts/reset_root_passwd.yml
# ---
host_vars/mm-nd-test.oopen.de/mm-nd-common.yml → host_vars/mm-nd-test.oopen.de/mm-nd-test-common.yml
View File
host_vars/mm-nd-test.oopen.de/mm-nd-ipt-server.yml → host_vars/mm-nd-test.oopen.de/mm-nd-test-ipt-server.yml
View File
host_vars/munin.oopen.de/munin-ipt-server.yml
+25
View File
@@ -0,0 +1,25 @@
---
# ipt-firewall configuration for munin.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "37.27.121.227"
fw_ext_ips_v6:
- "2a01:4f9:3070:2bda::227"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
fw_munin_server_ips: $ext_1_ip
# --- HTTP
fw_http_server_ips: $ext_1_ip
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/mx.warenform.de/mx-ipt-server.yml
+35
View File
@@ -0,0 +1,35 @@
---
# ipt-firewall configuration for mx.warenform.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "83.223.86.76"
fw_ext_ips_v6:
- "2a01:30:0:13:231:32ff:fe8b:7763 2a01:30:0:505:231:32ff:fe8b:7763"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- HTTP
fw_http_server_ips: $ext_1_ip $ext_2_ip
# --- Mail
fw_smtpd_ips: $ext_1_ip
fw_mail_server_ips: $ext_1_ip
fw_mail_client_ips: $ext_1_ip
fw_dovecot_auth_service: true
fw_dovecot_auth_allowed_networks_v4: "meet.faire-integration.de"
fw_dovecot_auth_allowed_networks_v6: "meet.faire-integration.de"
# --- Rsync
fw_rsync_out_ips: $ext_1_ip
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/nd-archiv.warenform.de/nd-archiv-ipt-server.yml
+30
View File
@@ -0,0 +1,30 @@
---
# ipt-firewall configuration for nd-archiv.warenform.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "83.223.86.51"
fw_ext_ips_v6:
- "2a01:30:0:13:243:ff:feab:2b92 2a01:30:0:505:243:ff:feab:2b92"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Access control IPv4
fw_allow_ext_service_v4: "wf.oopen.de:9998:tcp"
# --- HTTP
fw_http_server_ips: $ext_1_ip
# --- Mail
fw_mail_client_ips: $ext_1_ip
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/nd-epaper.warenform.de/nd-epaper-ipt-server.yml
+30
View File
@@ -0,0 +1,30 @@
---
# ipt-firewall configuration for nd-epaper.warenform.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "83.223.86.90"
fw_ext_ips_v6:
- "2a01:30:0:505:2f4:30ff:fead:f4f 2a01:30:0:13:2f4:30ff:fead:f4f"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Access control IPv4
fw_allow_ext_service_v4: "wf.oopen.de:9998:tcp"
# --- HTTP
fw_http_server_ips: $ext_1_ip
# --- Mail
fw_mail_client_ips: $ext_1_ip
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/nd-live.warenform.de/nd-live-ipt-server.yml
+27
View File
@@ -0,0 +1,27 @@
---
# ipt-firewall configuration for nd-live.warenform.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "83.223.86.52"
fw_ext_ips_v6:
- "2a01:30:0:13:218:d3ff:fed6:74a2 2a01:30:0:505:218:d3ff:fed6:74a2"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Access control IPv4
fw_allow_ext_service_v4: "80.152.216.128:9998:tcp"
# --- HTTP
fw_http_server_ips: $ext_1_ip
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/ns.so36net.de/ns-ipt-server.yml
+41
View File
@@ -0,0 +1,41 @@
---
# ipt-firewall configuration for ns.so36net.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
- "eth1"
fw_ext_ips_v4:
- "192.68.11.77"
fw_ext_ips_v6:
- "2001:678:a40:3000::77"
- "2a01:30:1fff:fd00::207"
# --- Munin
munin_remote_ipv4: 192.68.11.73
munin_remote_ipv6: "2001:678:a40:3000::73"
# --- Forwarding
fw_forward_private_ips_v4: 192.168.63.0/24 10.0.202.0/24
# --- Access control IPv4
fw_allow_ext_service_v4: "138.201.23.195:1036:tcp"
# --- Access control IPv6
fw_allow_ext_service_v6: "2a01:4f8:171:2895::195,1036,tcp"
# --- SSH
fw_ssh_ports: 1036
# --- Mail
fw_dovecot_auth_port: 44444
# --- DNS
fw_dns_server_ips: $ext_ips
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/o12.oopen.de/o12-ipt-server.yml
+36
View File
@@ -0,0 +1,36 @@
---
# ipt-firewall configuration for o12.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "br0"
fw_ext_ips_v4:
- "83.223.86.115"
fw_ext_ips_v6:
- "2a01:30:0:13:5054:ff:fe2a:b776 2a01:30:0:505:5054:ff:fe2a:b776"
fw_lxc_guest_ips_v4:
- "83.223.86.116 83.223.86.117"
- "83.223.86.118"
- "83.223.86.119"
fw_lxc_guest_ips_v6:
- "2a01:30:0:13:2c5:48ff:feee:f21c 2a01:30:0:505:2c5:48ff:feee:f21c 2a01:30:0:13:2c5:48ff:feee:f21d 2a01:30:0:505:2c5:48ff:feee:f21d"
- "2a01:30:0:13:2c7:5bff:fe44:bd50 2a01:30:0:505:2c7:5bff:fe44:bd50"
- "2a01:30:0:13:218:f2ff:fe28:77ca 2a01:30:0:505:218:f2ff:fe28:77ca"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Bridged / LXC
fw_do_not_firewall_bridged_traffic: true
fw_do_not_firewall_lx_guest_systems: true
# --- VPN / WireGuard
fw_wireguard_server_ips: $ext_ips
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/o13-cryptpad.oopen.de/o13-cryptpad-ipt-server.yml
+29
View File
@@ -0,0 +1,29 @@
---
# ipt-firewall configuration for o13-cryptpad.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_interfaces_v6:
- "eth1"
fw_ext_ips_v4:
- "83.223.90.238"
fw_ext_ips_v6:
- "2a01:31:0:2::ad52:a238"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- HTTP
fw_http_server_ips: $ext_1_ip
# --- Mail
fw_mail_client_ips: $ext_1_ip
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/o13-git.oopen.de/o13-git-ipt-server.yml
+21
View File
@@ -0,0 +1,21 @@
---
# ipt-firewall configuration for o13-git.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "83.223.90.235"
fw_ext_ips_v6:
- "2a01:31:0:2::ad52:a235"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- HTTP
fw_http_server_ips: $ext_ips
host_vars/o13-mail.oopen.de/o13-mail-ipt-server.yml
+41
View File
@@ -0,0 +1,41 @@
---
# ipt-firewall configuration for o13-mail.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
- "eth1"
fw_ext_interfaces_v6:
- "eth2"
- "eth3"
fw_ext_ips_v4:
- "83.223.90.231"
- "83.223.90.232"
fw_ext_ips_v6:
- "2a01:31:0:2::ad52:a231"
- "2a01:31:0:2::ad52:a232"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Access control IPv4
fw_allow_ext_service_v4: "192.68.11.77:1036:tcp"
# --- Access control IPv6
fw_allow_ext_service_v6: "2001:678:a40:3000::77,1036,tcp"
# --- HTTP
fw_http_server_ips: $ext_1_ip $ext_2_ip
# --- Mail
fw_smtpd_ips: $ext_1_ip
fw_mail_server_ips: $ext_1_ip
fw_mail_client_ips: $ext_1_ip $ext_2_ip
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/o13-mumble.oopen.de/o13-mumble-ipt-server.yml
+29
View File
@@ -0,0 +1,29 @@
---
# ipt-firewall configuration for o13-mumble.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_interfaces_v6:
- "eth1"
fw_ext_ips_v4:
- "83.223.90.234"
fw_ext_ips_v6:
- "2a01:31:0:2::ad52:a234"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- HTTP
fw_http_server_ips: $ext_1_ip
# --- Mumble
fw_mumble_server_ips: $ext_1_ip
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/o13-pad.oopen.de/o13-pad-ipt-server.yml
+29
View File
@@ -0,0 +1,29 @@
---
# ipt-firewall configuration for o13-pad.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_interfaces_v6:
- "eth1"
fw_ext_ips_v4:
- "83.223.90.236"
fw_ext_ips_v6:
- "2a01:31:0:2::ad52:a236"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- HTTP
fw_http_server_ips: $ext_1_ip
# --- Mail
fw_mail_client_ips: $ext_1_ip
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/o13.oopen.de/o13-ipt-server.yml
+27
View File
@@ -0,0 +1,27 @@
---
# ipt-firewall configuration for o13.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "br0"
fw_ext_interfaces_v6:
- "brv6"
fw_ext_ips_v4:
- "83.223.90.230"
fw_ext_ips_v6:
- "2a01:31:0:2::ad52:a668"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Bridged / LXC
fw_do_not_firewall_bridged_traffic: true
fw_do_not_firewall_lx_guest_systems: true
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/o14.oopen.de/o14-ipt-server.yml
+30
View File
@@ -0,0 +1,30 @@
---
# ipt-firewall configuration for o14.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "194.36.145.189"
fw_ext_ips_v6:
- "2a03:4000:4d:2cd:3466:79ff:fe58:9bd8"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Bridged / LXC
fw_do_not_firewall_bridged_traffic: true
# --- HTTP
fw_http_server_ips: $ext_1_ip
# --- Mail
fw_mail_client_ips: $ext_1_ip
# --- FTP
fw_ftp_server_ips: $ext_1_ip
host_vars/o17.oopen.de/o17-ipt-server.yml
+39
View File
@@ -0,0 +1,39 @@
---
# ipt-firewall configuration for o17.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "br0"
fw_ext_ips_v4:
- "83.223.85.203"
fw_ext_ips_v6:
- "2a01:30:0:13:5054:ff:fe48:cedc 2a01:30:0:505:5054:ff:fe48:cedc"
fw_lxc_guest_ips_v4:
- "83.223.85.207"
- "83.223.85.205 83.223.85.206"
fw_lxc_guest_ips_v6:
- "2a01:30:0:13:243:c1ff:fea8:c906 2a01:30:0:505:243:c1ff:fea8:c906"
- "2a01:30:0:13:2eb:f4ff:feaa:d996 2a01:30:0:505:2eb:f4ff:feaa:d996 2a01:30:0:13:2eb:f4ff:feaa:d997 2a01:30:0:505:2eb:f4ff:feaa:d997"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Bridged / LXC
fw_do_not_firewall_bridged_traffic: true
fw_do_not_firewall_lx_guest_systems: true
# --- Forwarding
fw_kernel_activate_forwarding: true
# --- VPN / WireGuard
fw_vpn_server_ips: $ext_ips
fw_vpn_server_ips_v6: ""
fw_wireguard_server_ips: $ext_ips
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/o18.oopen.de/o18-ipt-server.yml
+26
View File
@@ -0,0 +1,26 @@
---
# ipt-firewall configuration for o18.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "br0"
fw_ext_ips_v4:
- "5.9.97.103"
fw_ext_ips_v6:
- "2a01:4f8:162:2477::2"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Bridged / LXC
fw_do_not_firewall_bridged_traffic: true
fw_do_not_firewall_lx_guest_systems: true
# --- Forwarding
fw_kernel_activate_forwarding: true
fw_kernel_forward_between_interfaces: true
host_vars/o19.oopen.de/o19-ipt-server.yml
+29
View File
@@ -0,0 +1,29 @@
---
# ipt-firewall configuration for o19.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "br0"
fw_ext_ips_v4:
- "37.27.121.254"
fw_ext_ips_v6:
- "2a01:4f9:3070:2bda::2"
fw_lxc_guest_ips_v6:
- "2a01:4f9:3070:2bda::218"
- "2a01:4f9:3070:2bda::221"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Bridged / LXC
fw_do_not_firewall_bridged_traffic: true
fw_do_not_firewall_lx_guest_systems: true
# --- Forwarding
fw_kernel_activate_forwarding: true
fw_kernel_forward_between_interfaces: true
host_vars/o20.oopen.de/o20-ipt-server.yml
+30
View File
@@ -0,0 +1,30 @@
---
# ipt-firewall configuration for o20.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "enp0s31f6"
fw_ext_ips_v4:
- "78.46.100.9"
fw_ext_ips_v6:
- "2a01:4f8:120:9353::2"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- HTTP
fw_http_server_ips: $ext_1_ip
# --- Mail
fw_mail_client_ips: $ext_1_ip
# --- FTP
fw_ftp_server_ips: $ext_1_ip
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/o21.oopen.de/o21-ipt-server.yml
+39
View File
@@ -0,0 +1,39 @@
---
# ipt-firewall configuration for o21.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "enp1s0"
fw_ext_interfaces_v6:
- "enp7s0"
fw_ext_ips_v4:
- "83.223.90.20"
fw_ext_ips_v6:
- "2a01:31:0:2::f851:1"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Access control IPv4
fw_restrict_local_service_to_net_v4: "83.223.86.121/32:83.223.90.20:3306:tcp 83.223.86.122/32:83.223.90.20:3306:tcp 83.223.86.124/32:83.223.90.20:3306:tcp"
# --- Access control IPv6
fw_restrict_local_service_to_net_v6: "2a01:30:0:505:263:20ff:feaa:7783,2a01:31:0:2::f851:1,3306,tcp 2a01:30:0:13:263:20ff:feaa:7783,2a01:31:0:2::f851:1,3306,tcp 2a01:30:0:505:230:54ff:fe71:e8a8,2a01:31:0:2::f851:1,3306,tcp 2a01:30:0:13:230:54ff:fe71:e8a8,2a01:31:0:2::f851:1,3306,tcp"
# --- HTTP
fw_http_server_ips: $ext_ips
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
# --- Protection / limits
fw_limit_connections_per_source_IP: false
fw_limit_connections_per_source_IP_v6: true
fw_per_IP_connection_limit: 2048
fw_per_IP_connection_limit_v6: 1024
fw_limit_new_tcp_connections_per_seconds_per_source_IP: false
host_vars/o22.oopen.de/o22-ipt-server.yml
+40
View File
@@ -0,0 +1,40 @@
---
# ipt-firewall configuration for o22.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "br0"
fw_ext_ips_v4:
- "83.223.86.120"
fw_ext_ips_v6:
- "2a01:30:0:13:5054:ff:fe9f:422f 2a01:30:0:505:5054:ff:fe9f:422f"
fw_lxc_guest_ips_v4:
- "83.223.86.121"
- "83.223.86.123"
- "83.223.86.122"
- "83.223.86.124"
- "83.223.86.125"
fw_lxc_guest_ips_v6:
- "2a01:30:0:13:2e0:7bff:fe9a:b18a 2a01:30:0:505:2e0:7bff:fe9a:b18a"
- "2a01:30:0:13:281:fdff:fe3f:3ada 2a01:30:0:505:281:fdff:fe3f:3ada"
- "2a01:30:0:13:230:54ff:fe71:e8a8 2a01:30:0:505:230:54ff:fe71:e8a8"
- "2a01:30:0:505:263:20ff:feaa:7783 2a01:30:0:13:263:20ff:feaa:7783"
- "2a01:30:0:13:2e2:5bff:fe28:8cb8 2a01:30:0:505:2e2:5bff:fe28:8cb8"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Bridged / LXC
fw_do_not_firewall_bridged_traffic: true
fw_do_not_firewall_lx_guest_systems: true
# --- Forwarding
fw_forward_private_ips_v4: 192.168.3.121 192.168.3.122 192.168.3.123 192.168.3.124 192.168.3.125
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/o23.oopen.de/o23-ipt-server.yml
+46
View File
@@ -0,0 +1,46 @@
---
# ipt-firewall configuration for o23.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "br0"
fw_ext_ips_v4:
- "159.69.74.150"
fw_ext_ips_v6:
- "2a01:4f8:231:19a7::2"
fw_lxc_guest_ips_v4:
- "195.201.179.131"
- "159.69.74.143"
- "159.69.74.144"
- "159.69.74.155"
- "159.69.74.147"
- "159.69.74.156"
fw_lxc_guest_ips_v6:
- "2a01:4f8:231:19a7::131"
- "2a01:4f8:231:19a7::143"
- "2a01:4f8:231:19a7::144"
- "2a01:4f8:231:19a7::155"
- "2a01:4f8:231:19a7::147"
- "2a01:4f8:231:19a7::156"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Bridged / LXC
fw_do_not_firewall_bridged_traffic: true
fw_do_not_firewall_lx_guest_systems: true
# --- Forwarding
fw_kernel_forward_between_interfaces: true
# --- Out ports
fw_tcp_out_ports: 1036
fw_tcp_out_ports_v6: ""
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/o24.oopen.de/o24-ipt-server.yml
+26
View File
@@ -0,0 +1,26 @@
---
# ipt-firewall configuration for o24.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "br0"
fw_ext_ips_v4:
- "157.90.140.173"
fw_ext_ips_v6:
- "2a01:4f8:2220:37c3::2"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Bridged / LXC
fw_do_not_firewall_bridged_traffic: true
fw_do_not_firewall_lx_guest_systems: true
# --- Forwarding
fw_kernel_activate_forwarding: true
fw_kernel_forward_between_interfaces: true
host_vars/o26.oopen.de/o26-ipt-server.yml
+28
View File
@@ -0,0 +1,28 @@
---
# ipt-firewall configuration for o26.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "enp6s0"
fw_ext_ips_v4:
- "37.27.129.85"
fw_ext_ips_v6:
- "2a01:4f9:3071:1141::2"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- SSH
fw_ssh_server_ips_v6: $ext_1_ip
# --- HTTP
fw_http_server_ips: $ext_1_ip
# --- Mail
fw_mail_client_ips: $ext_1_ip
fw_mail_client_ips_v6: ""
host_vars/o27.oopen.de/o27-ipt-server.yml
+34
View File
@@ -0,0 +1,34 @@
---
# ipt-firewall configuration for o27.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "br0"
fw_ext_ips_v4:
- "142.132.147.171"
fw_ext_ips_v6:
- "2a01:4f8:261:1994::2"
fw_lxc_guest_ips_v4:
- "142.132.147.170"
- "142.132.147.169"
fw_lxc_guest_ips_v6:
- "2a01:4f8:261:1994::170"
- "2a01:4f8:261:1994::169"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Bridged / LXC
fw_do_not_firewall_bridged_traffic: true
fw_do_not_firewall_lx_guest_systems: true
# --- Forwarding
fw_kernel_forward_between_interfaces: true
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/o28.oopen.de/o28-ipt-server.yml
+29
View File
@@ -0,0 +1,29 @@
---
# ipt-firewall configuration for o28.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "br0"
fw_ext_ips_v4:
- "88.198.56.204"
fw_ext_ips_v6:
- "2a01:4f8:222:2c2::2"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Bridged / LXC
fw_do_not_firewall_bridged_traffic: true
fw_do_not_firewall_lx_guest_systems: true
# --- Forwarding
fw_kernel_activate_forwarding: true
fw_kernel_forward_between_interfaces: true
# --- Mail
fw_smtpd_additional_outgoing_ports: 2525
host_vars/o29.oopen.de/o29-ipt-server.yml
+30
View File
@@ -0,0 +1,30 @@
---
# ipt-firewall configuration for o29.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "br0"
fw_ext_ips_v4:
- "65.21.220.154"
fw_ext_ips_v6:
- "2a01:4f9:3080:318c::2"
fw_lxc_guest_ips_v4:
- "65.21.220.152"
fw_lxc_guest_ips_v6:
- "2a01:4f9:3080:318c::152"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Bridged / LXC
fw_do_not_firewall_bridged_traffic: true
fw_do_not_firewall_lx_guest_systems: true
# --- Forwarding
fw_kernel_activate_forwarding: true
fw_kernel_forward_between_interfaces: true
host_vars/o30.oopen.de/o30-ipt-server.yml
+35
View File
@@ -0,0 +1,35 @@
---
# ipt-firewall configuration for o30.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "br0"
fw_ext_ips_v4:
- "148.251.14.157"
fw_ext_ips_v6:
- "2a01:4f8:201:7389::2"
fw_local_ips_v6:
- "2a01:4f8:201:7389::141"
- "2a01:4f8:201:7389::136"
fw_lxc_guest_ips_v4:
- "148.251.14.141"
- "148.251.14.136"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Bridged / LXC
fw_do_not_firewall_bridged_traffic: true
fw_do_not_firewall_lx_guest_systems: true
# --- Forwarding
fw_kernel_activate_forwarding: true
fw_kernel_forward_between_interfaces: true
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/o31.oopen.de/o31-ipt-server.yml
+36
View File
@@ -0,0 +1,36 @@
---
# ipt-firewall configuration for o31.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "br0"
fw_ext_ips_v4:
- "135.181.22.166"
fw_ext_ips_v6:
- "2a01:4f9:4b:46d1::2"
fw_lxc_guest_ips_v4:
- "135.181.22.153"
- "135.181.22.159"
- "135.181.22.161"
fw_lxc_guest_ips_v6:
- "2a01:4f9:4b:46d1::153"
- "2a01:4f9:4b:46d1::159"
- "2a01:4f9:4b:46d1::161"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Bridged / LXC
fw_do_not_firewall_bridged_traffic: true
fw_do_not_firewall_lx_guest_systems: true
# --- Forwarding
fw_kernel_forward_between_interfaces: true
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/o32.oopen.de/o32-common.yml
+12 -1
View File
@@ -139,6 +139,8 @@ network_interfaces:
sshd_login_grace_time: 0
sshd_permit_root_login: !!str "no"
# ---
# vars used by roles/common/tasks/apt.yml
@@ -151,7 +153,7 @@ sshd_login_grace_time: 0
# vars used by roles/common/tasks/systemd-resolved.yml
# ---
systemd_resolved: true
systemd_resolved: false
# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
# Primäre DNS-Adresse: 38.132.106.139
@@ -293,6 +295,11 @@ cron_user_entries:
hour: '05'
job: /root/bin/mysql/flush_host_cache.sh
- name: "Background job for nextcloud instance 'cloud.lubax.de'"
minute: '*/15'
hour: '*'
job: sudo -u "www-data" /usr/local/php/bin/php -f /var/www/cloud.lubax.de/htdocs/cron.php
- name: "Generate/Renew Let's Encrypt Certificates if needed (using dehydrated script)"
minute: '23'
hour: '05'
@@ -345,6 +352,10 @@ sudo_users:
#
# see: roles/common/tasks/vars
sudoers_file_user_privileges:
- name: back
entry: 'ALL=(www-data) NOPASSWD: /usr/local/php/bin/php'
# ---
# vars used by roles/common/tasks/caching-nameserver.yml
host_vars/cl-lubax.oopen.de/cl-lubax-ipt-server.yml → host_vars/o32.oopen.de/o32-ipt-server.yml
+3 -6
View File
@@ -1,9 +1,9 @@
---
# ipt-firewall configuration for cl-fm.oopen.de
# ipt-firewall configuration for o32.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/ipt_firewall.yml
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: true
fw_manage_config: false
# --- Network
fw_ext_interfaces:
@@ -22,6 +22,3 @@ fw_http_server_ips: $ext_1_ip
# --- Mail
fw_mail_client_ips: $ext_1_ip
# --- Block
# fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/o33-neu.oopen.de/o33-neu-common.yml
-78
View File
@@ -1,78 +0,0 @@
---
# ---
# vars used by roles/ansible_dependencies
# ---
# ---
# vars used by roles/ansible_user
# ---
# ---
# vars used by roles/common/tasks/basic.yml
# ---
# ---
# vars used by roles/common/tasks/sshd.yml
# ---
sshd_hostkeyalgorithms: []
# ---
# vars used by roles/common/tasks/apt.yml
# ---
# apt_manage_sources_list: false
# ---
# vars used by roles/common/tasks/users.yml
# ---
# ---
# vars used by roles/common/tasks/users-systemfiles.yml
# ---
# ---
# vars used by roles/common/tasks/webadmin-user.yml
# ---
# ---
# vars used by roles/common/tasks/sudoers.yml
# ---
#
# see: roles/common/tasks/vars
# ---
# vars used by roles/common/tasks/caching-nameserver.yml
# ---
# ---
# vars used by roles/common/tasks/git.yml
# ---
git_firewall_repository:
name: ipt-server
repo: https://git.oopen.de/firewall/ipt-server
dest: /usr/local/src/ipt-server
# ==============================
# ---
# vars used by scripts/reset_root_passwd.yml
# ---
root_user:
name: root
password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
host_vars/o35.oopen.de/o35-ipt-server.yml
+46
View File
@@ -0,0 +1,46 @@
---
# ipt-firewall configuration for o35.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "br0"
fw_ext_ips_v4:
- "95.217.204.218"
fw_ext_ips_v6:
- "2a01:4f9:4a:47e5::2"
fw_lxc_guest_ips_v4:
- "95.217.204.247"
- "95.217.204.204"
- "95.217.204.203"
- "95.217.204.227"
- "95.217.204.205"
- "95.217.204.206"
fw_lxc_guest_ips_v6:
- "2a01:4f9:4a:47e5::247"
- "2a01:4f9:4a:47e5::204"
- "2a01:4f9:4a:47e5::203"
- "2a01:4f9:4a:47e5::227"
- "2a01:4f9:4a:47e5::205"
- "2a01:4f9:4a:47e5::206"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Bridged / LXC
fw_do_not_firewall_bridged_traffic: true
fw_do_not_firewall_lx_guest_systems: true
# --- Forwarding
fw_kernel_activate_forwarding: true
fw_kernel_forward_between_interfaces: true
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
# --- Protection / limits
fw_limit_connections_per_source_IP_v6: false
host_vars/o36.oopen.de/o36-ipt-server.yml
+46
View File
@@ -0,0 +1,46 @@
---
# ipt-firewall configuration for o36.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "br0"
fw_ext_ips_v4:
- "162.55.82.89"
fw_ext_ips_v6:
- "2a01:4f8:271:1266::2"
fw_lxc_guest_ips_v4:
- "162.55.82.73"
- "162.55.82.74"
- "162.55.82.77"
- "162.55.82.78"
- "162.55.82.76"
- "162.55.82.75"
fw_lxc_guest_ips_v6:
- "2a01:4f8:271:1266::73"
- "2a01:4f8:271:1266::74"
- "2a01:4f8:271:1266::77"
- "2a01:4f8:271:1266::78"
- "2a01:4f8:271:1266::76"
- "2a01:4f8:271:1266::75"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Bridged / LXC
fw_do_not_firewall_bridged_traffic: true
fw_do_not_firewall_lx_guest_systems: true
# --- Forwarding
fw_kernel_activate_forwarding: true
fw_kernel_forward_between_interfaces: true
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
# --- Kernel IPv4
fw_kernel_support_dynaddr: true
host_vars/o38.oopen.de/o38-ipt-server.yml
+38
View File
@@ -0,0 +1,38 @@
---
# ipt-firewall configuration for o38.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "br0"
fw_ext_ips_v4:
- "213.133.111.115"
fw_ext_ips_v6:
- "2a01:4f8:222:161c::115"
fw_lxc_guest_ips_v4:
- "213.239.199.45"
- "213.239.199.46"
fw_lxc_guest_ips_v6:
- "2a01:4f8:222:161c::45"
- "2a01:4f8:222:161c::46"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Bridged / LXC
fw_do_not_firewall_bridged_traffic: true
fw_do_not_firewall_lx_guest_systems: true
# --- Forwarding
fw_kernel_activate_forwarding: true
fw_kernel_forward_between_interfaces: true
# --- SSH
fw_ssh_server_ips_v6: $ext_1_ip
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/o39.oopen.de/o39-ipt-server.yml
+40
View File
@@ -0,0 +1,40 @@
---
# ipt-firewall configuration for o39.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "br0"
fw_ext_ips_v4:
- "37.27.67.126"
fw_ext_ips_v6:
- "2a01:4f9:3081:34d1::126"
fw_lxc_guest_ips_v4:
- "37.27.67.114"
- "37.27.67.115"
- "37.27.67.116"
- "37.27.67.117"
- "37.27.67.118"
- "37.27.67.119"
fw_lxc_guest_ips_v6:
- "2a01:4f9:3081:34d1::114"
- "2a01:4f9:3081:34d1::115"
- "2a01:4f9:3081:34d1::116"
- "2a01:4f9:3081:34d1::117"
- "2a01:4f9:3081:34d1::118"
- "2a01:4f9:3081:34d1::119"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Bridged / LXC
fw_do_not_firewall_bridged_traffic: true
fw_do_not_firewall_lx_guest_systems: true
# --- Forwarding
fw_kernel_activate_forwarding: true
fw_kernel_forward_between_interfaces: true
host_vars/o40.oopen.de/o40-ipt-server.yml
+34
View File
@@ -0,0 +1,34 @@
---
# ipt-firewall configuration for o40.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "br0"
fw_ext_ips_v4:
- "176.9.125.12"
fw_ext_ips_v6:
- "2a01:4f8:151:8415::2"
fw_lxc_guest_ips_v4:
- "176.9.125.42"
- "176.9.125.5"
- "176.9.125.39"
fw_lxc_guest_ips_v6:
- "2a01:4f8:151:8415::42"
- "2a01:4f8:151:8415::5"
- "2a01:4f8:151:8415::39"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Bridged / LXC
fw_do_not_firewall_bridged_traffic: true
fw_do_not_firewall_lx_guest_systems: true
# --- Forwarding
fw_kernel_activate_forwarding: true
fw_kernel_forward_between_interfaces: true
host_vars/o42.oopen.de/o42-ipt-server.yml
+29
View File
@@ -0,0 +1,29 @@
---
# ipt-firewall configuration for o42.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "br0"
fw_ext_ips_v4:
- "95.217.194.43"
fw_ext_ips_v6:
- "2a01:4f9:4a:5114::2"
fw_lxc_guest_ips_v4:
- "95.217.194.17"
fw_lxc_guest_ips_v6:
- "2a01:4f9:4a:5114::17"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Bridged / LXC
fw_do_not_firewall_bridged_traffic: true
fw_do_not_firewall_lx_guest_systems: true
# --- Forwarding
fw_kernel_forward_between_interfaces: true
host_vars/o43.oopen.de/o43-ipt-server.yml
+42
View File
@@ -0,0 +1,42 @@
---
# ipt-firewall configuration for o43.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "br0"
fw_ext_ips_v4:
- "176.9.62.77"
fw_ext_ips_v6:
- "2a01:4f8:150:805b::2"
fw_local_interfaces:
- "br1"
fw_local_interfaces_v6: []
fw_lxc_guest_ips_v4:
- "176.9.62.69"
- "176.9.62.106"
fw_lxc_guest_ips_v6:
- "2a01:4f8:150:805b::69"
- "2a01:4f8:150:805b::106"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Bridged / LXC
fw_do_not_firewall_bridged_traffic: true
fw_do_not_firewall_lx_guest_systems: true
# --- Outgoing / interfaces
fw_unprotected_ifs: $local_if_1
fw_unprotected_ifs_v6: ""
# --- Forwarding
fw_kernel_activate_forwarding: true
fw_kernel_forward_between_interfaces: true
# --- Kernel IPv4
fw_dynaddr_flag: 1
host_vars/o44.oopen.de/o44-ipt-server.yml
+35
View File
@@ -0,0 +1,35 @@
---
# ipt-firewall configuration for o44.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "br0"
fw_ext_ips_v4:
- "148.251.194.59"
fw_ext_ips_v6:
- "2a01:4f8:211:f89::2"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Bridged / LXC
fw_do_not_firewall_bridged_traffic: true
fw_do_not_firewall_lx_guest_systems: true
# --- Forwarding
fw_kernel_activate_forwarding: true
fw_kernel_forward_between_interfaces: true
# --- HTTP
fw_http_server_ips: $ext_1_ip
# --- Mail
fw_mail_client_ips: $ext_1_ip
# --- Kernel IPv4
fw_dynaddr_flag: 1
host_vars/oolm-db.oopen.de
Symlink
+1
View File
@@ -0,0 +1 @@
o21.oopen.de
host_vars/oolm-db.oopen.de/oolm-db-common.yml
-72
View File
@@ -1,72 +0,0 @@
---
# ---
# vars used by roles/ansible_dependencies
# ---
# ---
# vars used by roles/ansible_user
# ---
# ---
# vars used by roles/common/tasks/basic.yml
# ---
# ---
# vars used by roles/common/tasks/sshd.yml
# ---
# sshd_pasword_auth_user:
# - chris
# sshd_pasword_auth_ip:
# - 2003:ec:df0c:e7fe:ebb:d93b:1d33:3918
# - 2003:ec:df0c:e7fe:4b3a:a5ba:c661:f7f6
# ---
# vars used by apt.yml
# ---
# ---
# vars used by roles/common/tasks/users.yml
# ---
# ---
# vars used by roles/common/tasks/users-systemfiles.yml
# ---
# ---
# vars used by roles/common/tasks/webadmin-user.yml
# ---
# ---
# vars used by roles/common/tasks/sudoers.yml
# ---
#
# see: roles/common/tasks/vars
# ---
# vars used by roles/common/tasks/caching-nameserver.yml
# ---
# ---
# vars used by roles/common/tasks/git.yml
# ---
#
# see: roles/common/tasks/vars
# ==============================
# ---
# vars used by scripts/reset_root_passwd.yml
# ---
host_vars/oolm-shop-dev.oopen.de/oolm-shop-dev-ipt-server.yml
+40
View File
@@ -0,0 +1,40 @@
---
# ipt-firewall configuration for oolm-shop-dev.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "83.223.86.122"
fw_ext_ips_v6:
- "2a01:30:0:505:230:54ff:fe71:e8a8 2a01:30:0:13:230:54ff:fe71:e8a8"
fw_local_interfaces:
- "eth1"
fw_local_interfaces_v6: []
fw_local_ips_v4:
- "192.168.3.122"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Outgoing / interfaces
fw_unprotected_ifs: eth1
fw_unprotected_ifs_v6: ""
# --- HTTP
fw_http_server_ips: $ext_1_ip
# --- Mail
fw_mail_client_ips: $ext_1_ip
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
# --- Protection / limits
fw_per_IP_connection_limit: 300
fw_limit_new_tcp_connections_per_seconds_per_source_IP: false
host_vars/oolm-web.oopen.de/oolm-web-ipt-server.yml
+39
View File
@@ -0,0 +1,39 @@
---
# ipt-firewall configuration for oolm-web.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "83.223.86.125"
fw_ext_ips_v6:
- "2a01:30:0:13:2e2:5bff:fe28:8cb8 2a01:30:0:505:2e2:5bff:fe28:8cb8"
fw_local_interfaces:
- "eth1"
fw_local_interfaces_v6: []
fw_local_ips_v4:
- "192.168.3.125"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Outgoing / interfaces
fw_unprotected_ifs: eth1
fw_unprotected_ifs_v6: ""
# --- HTTP
fw_http_server_ips: $ext_1_ip
# --- Mail
fw_mail_client_ips: $ext_1_ip
# --- FTP
fw_ftp_server_ips: $ext_1_ip
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/piwik.warenform.de/piwik-ipt-server.yml
+24
View File
@@ -0,0 +1,24 @@
---
# ipt-firewall configuration for piwik.warenform.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "83.223.86.84"
fw_ext_ips_v6:
- "2a01:30:0:13:25c:c8ff:fe1b:ea0c 2a01:30:0:505:25c:c8ff:fe1b:ea0c"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- HTTP
fw_http_server_ips: $ext_1_ip
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/prometheus-nd.oopen.de/prometheus-nd-ipt-server.yml
+30
View File
@@ -0,0 +1,30 @@
---
# ipt-firewall configuration for prometheus-nd.oopen.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "176.9.62.69"
fw_ext_ips_v6:
- "2a01:4f8:150:805b::69"
fw_local_interfaces:
- "eth1"
fw_local_interfaces_v6: []
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- HTTP
fw_http_server_ips: $ext_1_ip
# --- Mail
fw_mail_client_ips: $ext_1_ip
# --- Prometheus
fw_prometheus_local_server_ips: $ext_1_ip
host_vars/rage.so36.net/rage-ipt-server.yml
+54
View File
@@ -0,0 +1,54 @@
---
# ipt-firewall configuration for rage.so36.net
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "192.68.11.81"
- "192.68.11.90"
- "192.68.11.91"
fw_ext_ips_v6:
- "2001:678:a40:3000::81"
- "2001:678:a40:3000::90"
- "2001:678:a40:3000::91"
# --- Munin
munin_remote_ipv4: 192.68.11.73
munin_remote_ipv6: "2001:678:a40:3000::73"
# --- Access control IPv4
fw_allow_ext_service_v4: "192.68.11.77:1036:tcp 138.201.23.195:1036:tcp"
# --- Access control IPv6
fw_restrict_local_service_to_net_v6: "2001:678:a40:3000::79,$ext_1_ip,44444,tcp"
fw_allow_ext_service_v6: "2001:678:a40:3000::77,1036,tcp 2a01:4f8:171:2895::195,1036,tcp"
# --- SSH
fw_ssh_ports: 1036
# --- HTTP
fw_http_server_ips: $ext_ips
# --- Mail
fw_smtpd_ips: $ext_1_ip
fw_mail_server_ips: $ext_1_ip
fw_mail_client_ips: $ext_ips
fw_dovecot_auth_service: true
fw_dovecot_auth_service_v6: false
fw_dovecot_auth_port: 44444
fw_dovecot_auth_allowed_networks_v4: 192.68.11.79 83.223.85.204
# --- Rsync
fw_rsync_out_ips: $ext_1_ip
# --- Out ports
fw_tcp_out_ports: 1036
fw_tcp_out_ports_v6: ""
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/resolver-a.so36.net/resolver-a-ipt-server.yml
+38
View File
@@ -0,0 +1,38 @@
---
# ipt-firewall configuration for resolver-a.so36.net
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "192.68.11.71"
fw_ext_ips_v6:
- "2001:678:a40:3000::71"
# --- Munin
munin_remote_ipv4: 192.68.11.73
munin_remote_ipv6: "2001:678:a40:3000::73"
# --- Access control IPv4
fw_allow_ext_service_v4: "138.201.23.195:1036:tcp"
# --- Access control IPv6
fw_allow_ext_service_v6: "2a01:4f8:171:2895::195,1036,tcp"
# --- SSH
fw_ssh_ports: 1036
# --- Mail
fw_dovecot_auth_port: 44444
# --- DNS
fw_local_resolver_service: true
fw_resolver_allowed_networks_v4: 192.68.11.64/27 194.150.169.136/29 138.201.23.195 138.201.23.196
fw_resolver_allowed_networks_v6: "2001:678:a40:3000::/64 2a01:4f8:171:2895::195 2a01:4f8:171:2895::196"
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/resolver-b.so36.net/resolver-b-ipt-server.yml
+38
View File
@@ -0,0 +1,38 @@
---
# ipt-firewall configuration for resolver-b.so36.net
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "192.68.11.78"
fw_ext_ips_v6:
- "2001:678:a40:3000::78"
# --- Munin
munin_remote_ipv4: 192.68.11.73
munin_remote_ipv6: "2001:678:a40:3000::73"
# --- Access control IPv4
fw_allow_ext_service_v4: "138.201.23.195:1036:tcp"
# --- Access control IPv6
fw_allow_ext_service_v6: "2a01:4f8:171:2895::195,1036,tcp"
# --- SSH
fw_ssh_ports: 1036
# --- Mail
fw_dovecot_auth_port: 44444
# --- DNS
fw_local_resolver_service: true
fw_resolver_allowed_networks_v4: 192.68.11.64/27 194.150.169.136/29 138.201.23.195 138.201.23.196
fw_resolver_allowed_networks_v6: "2001:678:a40:3000::/64 2a01:4f8:171:2895::195 2a01:4f8:171:2895::196"
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/schleuder3.so36.net/schleuder3-ipt-server.yml
+34
View File
@@ -0,0 +1,34 @@
---
# ipt-firewall configuration for schleuder3.so36.net
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "192.68.11.84"
fw_ext_ips_v6:
- "2001:678:a40:3000::84"
# --- Munin
munin_remote_ipv4: 192.68.11.73
munin_remote_ipv6: "2001:678:a40:3000::73"
# --- Access control IPv4
fw_allow_ext_service_v4: "192.68.11.77:1036:tcp 138.201.23.195:1036:tcp"
# --- Access control IPv6
fw_allow_ext_service_v6: "2001:678:a40:3000::77,1036,tcp 2a01:4f8:171:2895::195,1036,tcp"
# --- SSH
fw_ssh_ports: 1036
# --- HTTP
fw_http_server_ips: $ext_1_ip
# --- Mail
fw_smtpd_ips: $ext_1_ip
fw_dovecot_auth_port_v6: 44444
host_vars/server18.warenform.de/server18-ipt-server.yml
+29
View File
@@ -0,0 +1,29 @@
---
# ipt-firewall configuration for server18.warenform.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "br0"
fw_ext_ips_v4:
- "83.223.86.80"
fw_ext_ips_v6:
- "2a01:30:0:13:5054:ff:fea0:aa34 2a01:30:0:505:5054:ff:fea0:aa34"
fw_lxc_guest_ips_v4:
- "83.223.86.84"
fw_lxc_guest_ips_v6:
- "2a01:30:0:13:25c:c8ff:fe1b:ea0c 2a01:30:0:505:25c:c8ff:fe1b:ea0c"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Bridged / LXC
fw_do_not_firewall_bridged_traffic: true
fw_do_not_firewall_lx_guest_systems: true
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/server22.warenform.de/server22-ipt-server.yml
+41
View File
@@ -0,0 +1,41 @@
---
# ipt-firewall configuration for server22.warenform.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "br0"
- "eth2"
- "eth3"
fw_ext_interfaces_v6:
- "br0"
fw_ext_ips_v4:
- "83.223.83.20"
- "83.223.89.50"
- "83.223.85.70"
fw_ext_ips_v6:
- "2a01:30:0:13:5054:ff:fe21:682f/128 2a01:30:0:505:5054:ff:fe21:682f/128"
fw_lxc_guest_ips_v4:
- "83.223.86.50 83.223.86.53"
- "83.223.86.51"
- "83.223.86.90"
- "83.223.86.52"
fw_lxc_guest_ips_v6:
- "2a01:30:0:13:201:82ff:fedf:737a 2a01:30:0:505:201:82ff:fedf:737a 2a01:30:0:13:2f4:75ff:fe1e:376f 2a01:30:0:505:2f4:75ff:fe1e:376f"
- "2a01:30:0:13:243:ff:feab:2b92 2a01:30:0:505:243:ff:feab:2b92"
- "2a01:30:0:13:2f4:30ff:fead:f4f 2a01:30:0:505:2f4:30ff:fead:f4f"
- "2a01:30:0:13:218:d3ff:fed6:74a2 2a01:30:0:505:218:d3ff:fed6:74a2"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Bridged / LXC
fw_do_not_firewall_bridged_traffic: true
fw_do_not_firewall_lx_guest_systems: true
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/server23.warenform.de/server23-ipt-server.yml
+33
View File
@@ -0,0 +1,33 @@
---
# ipt-firewall configuration for server23.warenform.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "br0"
fw_ext_ips_v4:
- "83.223.86.110"
fw_ext_ips_v6:
- "2a01:30:0:13:5054:ff:fe41:af9b 2a01:30:0:505:5054:ff:fe41:af9b"
fw_lxc_guest_ips_v4:
- "83.223.86.113"
- "83.223.86.112"
- "83.223.86.111"
fw_lxc_guest_ips_v6:
- "2a01:30:0:13:2fe:f9ff:fe23:24c4 2a01:30:0:505:2fe:f9ff:fe23:24c4"
- "2a01:30:0:13:2e7:f7ff:fec3:19bc 2a01:30:0:505:2e7:f7ff:fec3:19bc"
- "2a01:30:0:13:2db:b2ff:fef7:9647 2a01:30:0:505:2db:b2ff:fef7:9647"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Bridged / LXC
fw_do_not_firewall_bridged_traffic: true
fw_do_not_firewall_lx_guest_systems: true
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/server24.warenform.de/server24-ipt-server.yml
+31
View File
@@ -0,0 +1,31 @@
---
# ipt-firewall configuration for server24.warenform.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "br0"
fw_ext_ips_v4:
- "83.223.86.75"
fw_ext_ips_v6:
- "2a01:30:0:13:5054:ff:fe6a:7f8d 2a01:30:0:505:5054:ff:fe6a:7f8d"
fw_lxc_guest_ips_v4:
- "83.223.86.78"
- "83.223.86.76"
fw_lxc_guest_ips_v6:
- "2a01:30:0:13:223:35ff:fef5:84b6 2a01:30:0:505:223:35ff:fef5:84b6"
- "2a01:30:0:13:231:32ff:fe8b:7763 2a01:30:0:505:231:32ff:fe8b:7763"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Bridged / LXC
fw_do_not_firewall_bridged_traffic: true
fw_do_not_firewall_lx_guest_systems: true
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/server25.warenform.de/server25-ipt-server.yml
+33
View File
@@ -0,0 +1,33 @@
---
# ipt-firewall configuration for server25.warenform.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "br0"
fw_ext_ips_v4:
- "83.223.85.163"
fw_ext_ips_v6:
- "2a01:30:0:13:5054:ff:fef7:c0fb 2a01:30:0:505:5054:ff:fef7:c0fb"
fw_lxc_guest_ips_v4:
- "83.223.85.164"
- "83.223.85.165"
- "83.223.85.166"
fw_lxc_guest_ips_v6:
- "2a01:30:0:13:286:96ff:fe4a:6eee 2a01:30:0:505:286:96ff:fe4a:6eee"
- "2a01:30:0:13:234:5fff:fed7:5d81 2a01:30:0:505:234:5fff:fed7:5d81"
- "2a01:30:0:13:234:5fff:fed7:5d82 2a01:30:0:505:234:5fff:fed7:5d82"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Bridged / LXC
fw_do_not_firewall_bridged_traffic: true
fw_do_not_firewall_lx_guest_systems: true
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/server26.warenform.de/server26-ipt-server.yml
+34
View File
@@ -0,0 +1,34 @@
---
# ipt-firewall configuration for server26.warenform.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "br0"
fw_ext_ips_v4:
- "178.63.33.18"
fw_ext_ips_v6:
- "2a01:4f8:110:401b::2"
fw_lxc_guest_ips_v4:
- "78.46.47.84"
- "78.46.47.82"
fw_lxc_guest_ips_v6:
- "2a01:4f8:110:401b::84"
- "2a01:4f8:110:401b::82"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Bridged / LXC
fw_do_not_firewall_bridged_traffic: true
fw_do_not_firewall_lx_guest_systems: true
# --- Forwarding
fw_kernel_forward_between_interfaces: true
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/server27.warenform.de/server27-ipt-server.yml
+34
View File
@@ -0,0 +1,34 @@
---
# ipt-firewall configuration for server27.warenform.de
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "br0"
fw_ext_ips_v4:
- "95.217.44.220"
fw_ext_ips_v6:
- "2a01:4f9:2a:3163::2"
fw_lxc_guest_ips_v4:
- "95.217.48.77"
- "95.217.54.30"
fw_lxc_guest_ips_v6:
- "2a01:4f9:2a:3163::77"
- "2a01:4f9:2a:3163::30"
# --- Munin
munin_remote_ipv4: 37.27.121.227
munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
# --- Bridged / LXC
fw_do_not_firewall_bridged_traffic: true
fw_do_not_firewall_lx_guest_systems: true
# --- Forwarding
fw_kernel_forward_between_interfaces: true
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
host_vars/shell.so36.net/shell-ipt-server.yml
+40
View File
@@ -0,0 +1,40 @@
---
# ipt-firewall configuration for shell.so36.net
# Generated by extract-fw-host-vars.py - review before committing!
# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
fw_manage_config: false
# --- Network
fw_ext_interfaces:
- "eth0"
fw_ext_ips_v4:
- "192.68.11.80"
fw_ext_ips_v6:
- "2001:678:a40:3000::80"
# --- Munin
munin_remote_ipv4: 192.68.11.73
munin_remote_ipv6: "2001:678:a40:3000::73"
# --- Access control IPv4
fw_allow_ext_service_v4: "192.68.11.64/27:1036:tcp 138.201.23.195:1036:tcp"
# --- Access control IPv6
fw_allow_ext_service_v6: "2001:678:a40:3000::/64,1036,tcp 2a01:4f8:171:2895::195,1036,tcp"
# --- SSH
fw_ssh_ports: 1036
# --- Mail
fw_dovecot_auth_port: 44444
# --- VPN / WireGuard
fw_vpn_server_ips: 192.68.11.80
fw_vpn_server_ips_v6: "2001:678:a40:3000::80"
# --- Out ports
fw_tcp_out_ports: 5222 6667 6697 7000
# --- Block
fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14

Some files were not shown because too many files have changed in this diff Show More