Role ipt-server: sync with ipt-server repo (93d9af8); adapt extract-fw-host-vars.py.

- Update firewall scripts and shared conf files from firewall/ipt-server
  (HTTP connection limits, IPv6 TCP MSS clamping, ban_ipv6_mask,
  mattermost TCP fallback, rename 'stansard_*' -> 'standard_*').
- New role variables: fw_set_max_new_http_conn_per_ip_per_second,
  fw_max_http_new_conn_per_ip_per_second, fw_set_max_concurrent_http_conn_per_ip,
  fw_max_concurrent_http_conn_per_ip, fw_set_max_new_http_conn_per_second,
  fw_max_new_http_conn_per_second, fw_throttle_tcp6_mss_for_https,
  fw_tcp6_mss_for_https_val, fw_mm_tcp_ports_in, fw_ban_ipv6_mask.
- Split fw_blocked_ips into fw_blocked_ips_v4 / fw_blocked_ips_v6 and
  rename it in host_vars accordingly.
- Restart firewall when scripts or shared conf files change.
- extract-fw-host-vars.py: map new variables, normalize '${var}' and renamed
  bash variables, fall back to IPv6 for shared variables and warn if IPv4
  and IPv6 values differ.
- README.md / MIGRATION.md: document host_vars naming
  (<short-hostname>-ipt-server.yml) and new variables.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/ipt-server/defaults/main.yml

@@ -2,7 +2,7 @@
 
 # ---
 # ipt-firewall role defaults
-# Override per host in host_vars/<hostname>/ipt_firewall.yml
+# Override per host in host_vars/<hostname>/<short-hostname>-ipt-server.yml
 # ---
 
 
@@ -156,6 +156,19 @@ fw_http_ports: "$standard_http_ports"
 fw_log_cgi_traffic_out: false
 fw_cgi_script_users: ""
 
+# Restrictions on HTTP(S) connections (ports 80,443) to counteract attacks.
+# Values default to the 'default_*' settings in default_settings.conf.
+fw_set_max_new_http_conn_per_ip_per_second: true
+fw_max_http_new_conn_per_ip_per_second: "$default_max_http_new_conn_per_ip_per_second"
+fw_set_max_concurrent_http_conn_per_ip: true
+fw_max_concurrent_http_conn_per_ip: "$default_max_concurrent_http_conn_per_ip"
+fw_set_max_new_http_conn_per_second: true
+fw_max_new_http_conn_per_second: "$default_max_new_http_conn_per_second"
+
+# IPv6 only: clamp the advertised MSS of incoming HTTPS SYN packets.
+fw_throttle_tcp6_mss_for_https: false
+fw_tcp6_mss_for_https_val: "$min_tcp6_mss_for_https_val"
+
 
 # ---
 # Services: Mattermost
@@ -163,8 +176,9 @@ fw_cgi_script_users: ""
 
 fw_mm_server_ips: ""
 fw_forward_mm_server_ips: ""
-fw_mm_udp_ports_in: "$stansard_mattermost_udp_ports_in"
-fw_mm_udp_ports_out: "$stansard_mattermost_udp_ports_out"
+fw_mm_udp_ports_in: "$standard_mattermost_udp_ports_in"
+fw_mm_tcp_ports_in: "$standard_mattermost_tcp_ports_in"
+fw_mm_udp_ports_out: "$standard_mattermost_udp_ports_out"
 
 
 # ---
@@ -320,7 +334,9 @@ fw_portforward_udp_v6: ""
 # Blocked IPs / ports
 # ---
 
-fw_blocked_ips: ""
+fw_blocked_ips_v4: ""
+fw_blocked_ips_v6: ""
+fw_ban_ipv6_mask: "$default_ban_ipv6_mask"   # IPv6 only: prefix length for ban_ipv6.list entries without mask
 fw_block_tcp_ports: "111 113 135 137:139 445"
 fw_block_udp_ports: "111 137:139"