Role ipt-server: allow IPv6-only overrides of shared variables; migrate nd, oolm-shop, web-01, web0.

Shared variables (and fw_ext_interfaces / fw_local_interfaces) can now be
overridden for IPv6 via <name>_v6. extract-fw-host-vars.py emits these
overrides when the IPv4 and IPv6 configs differ, instead of a warning.

Add host_vars for nd.warenform.de, oolm-shop.oopen.de, web-01.oopen.de
and web0.warenform.de (fw_manage_config: true).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

host_vars/nd.warenform.de/nd-ipt-server.yml

@@ -0,0 +1,43 @@
+---
+# ipt-firewall configuration for nd.warenform.de
+# Generated by extract-fw-host-vars.py - review before committing!
+# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
+
+fw_manage_config: true
+
+# --- Network
+fw_ext_interfaces:
+  - "eth0"
+  - "eth1"
+fw_ext_ips_v4:
+  - "83.223.86.50"
+  - "83.223.86.53"
+fw_ext_ips_v6:
+  - "2a01:30:0:13:2f4:75ff:fe1e:376f 2a01:30:0:505:2f4:75ff:fe1e:376f"
+  - "2a01:30:0:13:201:82ff:fedf:737a 2a01:30:0:505:201:82ff:fedf:737a"
+
+# --- Munin
+munin_remote_ipv4: 37.27.121.227
+munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
+
+# --- Access control IPv4
+fw_allow_ext_service_v4: "xkat.catalogue.librinet.de:8097:tcp wf.oopen.de:9998:tcp"
+
+# --- HTTP
+fw_http_server_ips: $ext_1_ip $ext_2_ip
+
+# --- Mail
+fw_mail_client_ips: $ext_1_ip
+
+# --- VPN / WireGuard
+fw_wireguard_server_ips: $ext_ips
+
+# --- FTP
+fw_ftp_server_ips: $ext_2_ip
+
+# --- Block
+fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
+
+# --- Protection / limits
+fw_per_IP_connection_limit: 501
+fw_limit_new_tcp_connections_per_seconds_per_source_IP: false