Role ipt-server: allow IPv6-only overrides of shared variables; migrate nd, oolm-shop, web-01, web0.

Shared variables (and fw_ext_interfaces / fw_local_interfaces) can now be overridden for IPv6 via <name>_v6. extract-fw-host-vars.py emits these overrides when the IPv4 and IPv6 configs differ, instead of a warning. Add host_vars for nd.warenform.de, oolm-shop.oopen.de, web-01.oopen.de and web0.warenform.de (fw_manage_config: true). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-03 00:50:03 +01:00
parent fe2e749b63
commit 3d6840ef3a
8 changed files with 320 additions and 123 deletions
@@ -0,0 +1,47 @@
+---
+# ipt-firewall configuration for oolm-shop.oopen.de
+# Generated by extract-fw-host-vars.py - review before committing!
+# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
+
+fw_manage_config: true
+
+# --- Network
+fw_ext_interfaces:
+  - "eth0"
+fw_ext_ips_v4:
+  - "83.223.86.124"
+fw_ext_ips_v6:
+  - "2a01:30:0:505:263:20ff:feaa:7783 2a01:30:0:13:263:20ff:feaa:7783"
+fw_local_interfaces:
+  - "eth1"
+fw_local_interfaces_v6: []
+fw_local_ips_v4:
+  - "192.168.3.124"
+
+# --- Munin
+munin_remote_ipv4: 37.27.121.227
+munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
+
+# --- Outgoing / interfaces
+fw_unprotected_ifs: eth1
+fw_unprotected_ifs_v6: ""
+
+# --- HTTP
+fw_http_server_ips: $ext_1_ip
+
+# --- Mail
+fw_mail_client_ips: $ext_1_ip
+
+# --- FTP
+fw_ftp_server_ips: $ext_1_ip
+
+# --- Block
+fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
+
+# --- Protection / limits
+fw_limit_connections_per_source_IP: false
+fw_limit_connections_per_source_IP_v6: true
+fw_per_IP_connection_limit: 2048
+fw_per_IP_connection_limit_v6: 1024
+fw_limit_new_tcp_connections_per_seconds_per_source_IP: false
+fw_limit_new_tcp_connections_per_seconds_per_source_IP_v6: true