Role ipt-server: sync with ipt-server repo (93d9af8); adapt extract-fw-host-vars.py.

- Update firewall scripts and shared conf files from firewall/ipt-server
  (HTTP connection limits, IPv6 TCP MSS clamping, ban_ipv6_mask,
  mattermost TCP fallback, rename 'stansard_*' -> 'standard_*').
- New role variables: fw_set_max_new_http_conn_per_ip_per_second,
  fw_max_http_new_conn_per_ip_per_second, fw_set_max_concurrent_http_conn_per_ip,
  fw_max_concurrent_http_conn_per_ip, fw_set_max_new_http_conn_per_second,
  fw_max_new_http_conn_per_second, fw_throttle_tcp6_mss_for_https,
  fw_tcp6_mss_for_https_val, fw_mm_tcp_ports_in, fw_ban_ipv6_mask.
- Split fw_blocked_ips into fw_blocked_ips_v4 / fw_blocked_ips_v6 and
  rename it in host_vars accordingly.
- Restart firewall when scripts or shared conf files change.
- extract-fw-host-vars.py: map new variables, normalize '${var}' and renamed
  bash variables, fall back to IPv6 for shared variables and warn if IPv4
  and IPv6 values differ.
- README.md / MIGRATION.md: document host_vars naming
  (<short-hostname>-ipt-server.yml) and new variables.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/ipt-server/files/etc/ipt-firewall/default_settings.conf

@@ -4,7 +4,7 @@
 # --- Default Parameter / Options
 # -------------
 
-default_per_IP_connection_limit=111
+default_per_IP_connection_limit=250
 
 
 # -------------
@@ -56,8 +56,9 @@ standard_prometheus_ports="9100,9256"
 
 # - Mattermost (MM) Service
 # -
-stansard_mattermost_udp_ports_in="8443"
-stansard_mattermost_udp_ports_out="3478"
+standard_mattermost_udp_ports_in="8443"
+standard_mattermost_tcp_ports_in="8443"
+standard_mattermost_udp_ports_out="3478"
 
 # - IPsec - Internet Security Association and
 # -  Key Management Protocol
@@ -70,6 +71,37 @@ standard_ipsec_nat_t=4500
 standard_http_ports="80,443"
 standard_mailuser_ports="587,465,110,995,143,993"
 
+
+# ip6t-firewall-server:
+#     Clamp the advertised MSS of incoming HTTPS SYN packets to 1360.
+#
+throttle_tcp6_mss_for_https=false
+min_tcp6_mss_for_https_val=1280
+
+# ip6t-firewall-server,ipt-firewall-server:
+#     some restrictions on HTTP connections to counteract attacks.
+#
+# The default value used to be set to '30'
+#
+set_max_new_http_conn_per_ip_per_second=true
+default_max_http_new_conn_per_ip_per_second=200
+
+# The default value used to be set to '50'
+#
+set_max_concurrent_http_conn_per_ip=true
+default_max_concurrent_http_conn_per_ip=100
+
+# The default value used to be set to '200'
+#
+set_max_new_http_conn_per_second=true
+default_max_new_http_conn_per_second=400
+
+# ip6t-firewall-server:
+#     Prefix length for entries in 'ban_ipv6.list' given without mask.
+#
+default_ban_ipv6_mask=128
+
+
 # - Dovecot Service
 # -
 dovecot_external_auth_port="44444"
@@ -85,20 +117,20 @@ default_jitsi_dovecout_auth_port="$dovecot_external_auth_port"
 default_jibri_out_port=5222
 # default_outbound_streaming_tcp_ports
 #
-#    - outbound port 1935/TCP : outbound streaming over RTMP to most 
+#    - outbound port 1935/TCP : outbound streaming over RTMP to most
 #      streaming providers such as YouTube Live, Vimeo or Twitch
 #
-#    - outbound port 1936/TCP  : outbound streaming over RTMP to LinkedIn 
+#    - outbound port 1936/TCP  : outbound streaming over RTMP to LinkedIn
 #      Live (port 1935 is also used for RTMP streaming to LinkedIn)
 #
-#    - outbound ports 2935/TCP and 2396/TCP : outbound streaming over 
+#    - outbound ports 2935/TCP and 2396/TCP : outbound streaming over
 #      RTMPS to LinkedIn Live
 #
-#    - outbound port 443/TCP (HTTPS) : used for authentication with the 
-#      built-in providers such as YouTube Live, Facebook Live, Ustream, 
+#    - outbound port 443/TCP (HTTPS) : used for authentication with the
+#      built-in providers such as YouTube Live, Facebook Live, Ustream,
 #      Livestream, and Twitch
 #
-#    - outbound port 53/UDP (DNS) used for DNS lookups converting 
+#    - outbound port 53/UDP (DNS) used for DNS lookups converting
 #      hostnames to IP addresses
 #
 default_outbound_streaming_tcp_ports="1935,1936,2935,2396"