Role ipt-server: sync with ipt-server repo (93d9af8); adapt extract-fw-host-vars.py.

- Update firewall scripts and shared conf files from firewall/ipt-server
  (HTTP connection limits, IPv6 TCP MSS clamping, ban_ipv6_mask,
  mattermost TCP fallback, rename 'stansard_*' -> 'standard_*').
- New role variables: fw_set_max_new_http_conn_per_ip_per_second,
  fw_max_http_new_conn_per_ip_per_second, fw_set_max_concurrent_http_conn_per_ip,
  fw_max_concurrent_http_conn_per_ip, fw_set_max_new_http_conn_per_second,
  fw_max_new_http_conn_per_second, fw_throttle_tcp6_mss_for_https,
  fw_tcp6_mss_for_https_val, fw_mm_tcp_ports_in, fw_ban_ipv6_mask.
- Split fw_blocked_ips into fw_blocked_ips_v4 / fw_blocked_ips_v6 and
  rename it in host_vars accordingly.
- Restart firewall when scripts or shared conf files change.
- extract-fw-host-vars.py: map new variables, normalize '${var}' and renamed
  bash variables, fall back to IPv6 for shared variables and warn if IPv4
  and IPv6 values differ.
- README.md / MIGRATION.md: document host_vars naming
  (<short-hostname>-ipt-server.yml) and new variables.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/ipt-server/templates/etc/ipt-firewall/main_ipv4.conf.j2

@@ -137,6 +137,16 @@ http_ports="{{ fw_http_ports }}"
 log_cgi_traffic_out={{ fw_log_cgi_traffic_out | lower }}
 cgi_script_users="{{ fw_cgi_script_users }}"
 
+# Restrictions on HTTP(S) connections to counteract attacks
+set_max_new_http_conn_per_ip_per_second={{ fw_set_max_new_http_conn_per_ip_per_second | lower }}
+max_http_new_conn_per_ip_per_second="{{ fw_max_http_new_conn_per_ip_per_second }}"
+
+set_max_concurrent_http_conn_per_ip={{ fw_set_max_concurrent_http_conn_per_ip | lower }}
+max_concurrent_http_conn_per_ip="{{ fw_max_concurrent_http_conn_per_ip }}"
+
+set_max_new_http_conn_per_second={{ fw_set_max_new_http_conn_per_second | lower }}
+max_new_http_conn_per_second="{{ fw_max_new_http_conn_per_second }}"
+
 
 # -------------
 # --- Services: Mattermost
@@ -145,6 +155,7 @@ cgi_script_users="{{ fw_cgi_script_users }}"
 mm_server_ips="{{ fw_mm_server_ips }}"
 forward_mm_server_ips="{{ fw_forward_mm_server_ips }}"
 mm_udp_ports_in="{{ fw_mm_udp_ports_in }}"
+mm_tcp_ports_in="{{ fw_mm_tcp_ports_in }}"
 mm_udp_ports_out="{{ fw_mm_udp_ports_out }}"
 
 
@@ -305,7 +316,7 @@ portforward_udp="{{ fw_portforward_udp_v4 }}"
 # --- Blocked IPs / Ports
 # -------------
 
-blocked_ips="{{ fw_blocked_ips }}"
+blocked_ips="{{ fw_blocked_ips_v4 }}"
 block_tcp_ports="{{ fw_block_tcp_ports }}"
 block_udp_ports="{{ fw_block_udp_ports }}"
 

roles/ipt-server/templates/etc/ipt-firewall/main_ipv6.conf.j2

@@ -127,6 +127,20 @@ http_ports="{{ fw_http_ports }}"
 log_cgi_traffic_out={{ fw_log_cgi_traffic_out | lower }}
 cgi_script_users="{{ fw_cgi_script_users }}"
 
+# Restrictions on HTTP(S) connections to counteract attacks
+set_max_new_http_conn_per_ip_per_second={{ fw_set_max_new_http_conn_per_ip_per_second | lower }}
+max_http_new_conn_per_ip_per_second="{{ fw_max_http_new_conn_per_ip_per_second }}"
+
+set_max_concurrent_http_conn_per_ip={{ fw_set_max_concurrent_http_conn_per_ip | lower }}
+max_concurrent_http_conn_per_ip="{{ fw_max_concurrent_http_conn_per_ip }}"
+
+set_max_new_http_conn_per_second={{ fw_set_max_new_http_conn_per_second | lower }}
+max_new_http_conn_per_second="{{ fw_max_new_http_conn_per_second }}"
+
+# Clamp the advertised MSS of incoming HTTPS SYN packets
+throttle_tcp6_mss_for_https={{ fw_throttle_tcp6_mss_for_https | lower }}
+tcp6_mss_for_https_val="{{ fw_tcp6_mss_for_https_val }}"
+
 
 # -------------
 # --- Services: Mattermost
@@ -135,6 +149,7 @@ cgi_script_users="{{ fw_cgi_script_users }}"
 mm_server_ips="{{ fw_mm_server_ips }}"
 forward_mm_server_ips="{{ fw_forward_mm_server_ips }}"
 mm_udp_ports_in="{{ fw_mm_udp_ports_in }}"
+mm_tcp_ports_in="{{ fw_mm_tcp_ports_in }}"
 mm_udp_ports_out="{{ fw_mm_udp_ports_out }}"
 
 
@@ -295,7 +310,11 @@ portforward_udp="{{ fw_portforward_udp_v6 }}"
 # --- Blocked IPs / Ports
 # -------------
 
-blocked_ips="{{ fw_blocked_ips }}"
+blocked_ips="{{ fw_blocked_ips_v6 }}"
+
+# Prefix length for entries in ban_ipv6.list given without mask
+ban_ipv6_mask="{{ fw_ban_ipv6_mask }}"
+
 block_tcp_ports="{{ fw_block_tcp_ports }}"
 block_udp_ports="{{ fw_block_udp_ports }}"