diff --git a/group_vars/all/main.yml b/group_vars/all/main.yml index 57c22ab..8156451 100644 --- a/group_vars/all/main.yml +++ b/group_vars/all/main.yml @@ -2668,22 +2668,14 @@ git_default_repositories: # --- # group [oopen_server] # --- -git_oopen_server_repositories: - - # firewall - - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server +# (ipt-server firewall is installed by the role 'ipt-server') +git_oopen_server_repositories: [] # --- # group [warenform_server] # --- -git_warenform_server_repositories: - - # firewall - - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server +# (ipt-server firewall is installed by the role 'ipt-server') +git_warenform_server_repositories: [] # --- # group [lxc_host] diff --git a/group_vars/oopen_server.yml b/group_vars/oopen_server.yml index 8bec79f..7415a1a 100644 --- a/group_vars/oopen_server.yml +++ b/group_vars/oopen_server.yml @@ -117,15 +117,6 @@ sudo_users: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/group_vars/so36_server.yml b/group_vars/so36_server.yml index 6a10835..a607293 100644 --- a/group_vars/so36_server.yml +++ b/group_vars/so36_server.yml @@ -54,12 +54,3 @@ sshd_ports: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - diff --git a/group_vars/warenform_server.yml b/group_vars/warenform_server.yml index 3840f11..c6d780b 100644 --- a/group_vars/warenform_server.yml +++ b/group_vars/warenform_server.yml @@ -119,15 +119,6 @@ sudo_users: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/backup.oopen.de/backup-common.yml b/host_vars/backup.oopen.de/backup-common.yml index 38abc3d..c147bec 100644 --- a/host_vars/backup.oopen.de/backup-common.yml +++ b/host_vars/backup.oopen.de/backup-common.yml @@ -398,15 +398,6 @@ sudoers_file_user_back_svn_privileges: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/backup.warenform.de/backup-common.yml b/host_vars/backup.warenform.de/backup-common.yml index 3e5adf9..b56fdab 100644 --- a/host_vars/backup.warenform.de/backup-common.yml +++ b/host_vars/backup.warenform.de/backup-common.yml @@ -286,15 +286,6 @@ sudo_users: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/formbricks-nd.oopen.de/formbricks-nd-common.yml b/host_vars/formbricks-nd.oopen.de/formbricks-nd-common.yml index c114af6..61f2b1f 100644 --- a/host_vars/formbricks-nd.oopen.de/formbricks-nd-common.yml +++ b/host_vars/formbricks-nd.oopen.de/formbricks-nd-common.yml @@ -177,15 +177,6 @@ sudo_users: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/git.oopen.de/git-common.yml b/host_vars/git.oopen.de/git-common.yml index 2bd9e80..a79f66a 100644 --- a/host_vars/git.oopen.de/git-common.yml +++ b/host_vars/git.oopen.de/git-common.yml @@ -126,15 +126,6 @@ sudoers_file_user_back_svn_privileges: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/git.warenform.de/git-common.yml b/host_vars/git.warenform.de/git-common.yml index 3117213..29dcf47 100644 --- a/host_vars/git.warenform.de/git-common.yml +++ b/host_vars/git.warenform.de/git-common.yml @@ -113,15 +113,6 @@ sudoers_file_user_back_svn_privileges: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/iam-nd.oopen.de/iam-nd-common.yml b/host_vars/iam-nd.oopen.de/iam-nd-common.yml index ab4a9f2..600c655 100644 --- a/host_vars/iam-nd.oopen.de/iam-nd-common.yml +++ b/host_vars/iam-nd.oopen.de/iam-nd-common.yml @@ -202,15 +202,6 @@ sudo_users: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/initiativenserver.oopen.de/initiativenserver-common.yml b/host_vars/initiativenserver.oopen.de/initiativenserver-common.yml index 5cfff9c..61f6025 100644 --- a/host_vars/initiativenserver.oopen.de/initiativenserver-common.yml +++ b/host_vars/initiativenserver.oopen.de/initiativenserver-common.yml @@ -123,15 +123,6 @@ resolved_fallback_nameserver: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/keycloak-nd.oopen.de/keycloak-nd-common.yml b/host_vars/keycloak-nd.oopen.de/keycloak-nd-common.yml index 8385a09..b12d5b8 100644 --- a/host_vars/keycloak-nd.oopen.de/keycloak-nd-common.yml +++ b/host_vars/keycloak-nd.oopen.de/keycloak-nd-common.yml @@ -203,15 +203,6 @@ sudo_users: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/lxc-host-kb.anw-kb.netz/lxc-host-kb-common.yml b/host_vars/lxc-host-kb.anw-kb.netz/lxc-host-kb-common.yml index 3a2d109..0b32e61 100644 --- a/host_vars/lxc-host-kb.anw-kb.netz/lxc-host-kb-common.yml +++ b/host_vars/lxc-host-kb.anw-kb.netz/lxc-host-kb-common.yml @@ -185,15 +185,6 @@ sudo_users: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/matomo-01.oopen.de/matomo-01-common.yml b/host_vars/matomo-01.oopen.de/matomo-01-common.yml index e4477dd..c63bc4d 100644 --- a/host_vars/matomo-01.oopen.de/matomo-01-common.yml +++ b/host_vars/matomo-01.oopen.de/matomo-01-common.yml @@ -127,15 +127,6 @@ resolved_fallback_nameserver: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/meet.akweb.de/meet-common.yml b/host_vars/meet.akweb.de/meet-common.yml index 1609d5d..9f3e71d 100644 --- a/host_vars/meet.akweb.de/meet-common.yml +++ b/host_vars/meet.akweb.de/meet-common.yml @@ -189,11 +189,6 @@ cron_user_entries: # # see: roles/common/tasks/vars -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - git_other_repositories: - name: jitsi repo: https://git.oopen.de/install/jitsi diff --git a/host_vars/meet.oopen.de/meet-common.yml b/host_vars/meet.oopen.de/meet-common.yml index 46c5479..c60ae1b 100644 --- a/host_vars/meet.oopen.de/meet-common.yml +++ b/host_vars/meet.oopen.de/meet-common.yml @@ -185,15 +185,6 @@ cron_user_entries: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - git_other_repositories: - name: jitsi repo: https://git.oopen.de/install/jitsi diff --git a/host_vars/mm-irights.oopen.de/mm-irights-common.yml b/host_vars/mm-irights.oopen.de/mm-irights-common.yml index 0f4a0a4..633ef47 100644 --- a/host_vars/mm-irights.oopen.de/mm-irights-common.yml +++ b/host_vars/mm-irights.oopen.de/mm-irights-common.yml @@ -179,15 +179,6 @@ cron_user_entries: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/mm-nd-test.oopen.de/mm-nd-test-common.yml b/host_vars/mm-nd-test.oopen.de/mm-nd-test-common.yml index 1152d33..96a41c6 100644 --- a/host_vars/mm-nd-test.oopen.de/mm-nd-test-common.yml +++ b/host_vars/mm-nd-test.oopen.de/mm-nd-test-common.yml @@ -202,15 +202,6 @@ sudo_users: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/mm-nd.oopen.de/mm-nd-common.yml b/host_vars/mm-nd.oopen.de/mm-nd-common.yml index 1152d33..96a41c6 100644 --- a/host_vars/mm-nd.oopen.de/mm-nd-common.yml +++ b/host_vars/mm-nd.oopen.de/mm-nd-common.yml @@ -202,15 +202,6 @@ sudo_users: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/mm-rav.oopen.de/mm-rav-common.yml b/host_vars/mm-rav.oopen.de/mm-rav-common.yml index d783678..af33869 100644 --- a/host_vars/mm-rav.oopen.de/mm-rav-common.yml +++ b/host_vars/mm-rav.oopen.de/mm-rav-common.yml @@ -184,15 +184,6 @@ cron_user_entries: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/mm.oopen.de/mm-common.yml b/host_vars/mm.oopen.de/mm-common.yml index 58178ad..0168711 100644 --- a/host_vars/mm.oopen.de/mm-common.yml +++ b/host_vars/mm.oopen.de/mm-common.yml @@ -130,15 +130,6 @@ sudoers_file_user_back_svn_privileges: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/munin.oopen.de/munin-common.yml b/host_vars/munin.oopen.de/munin-common.yml index ea6be7d..738429b 100644 --- a/host_vars/munin.oopen.de/munin-common.yml +++ b/host_vars/munin.oopen.de/munin-common.yml @@ -130,15 +130,6 @@ sudoers_file_user_back_svn_privileges: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/nd-archiv.warenform.de/nd-archiv-common.yml b/host_vars/nd-archiv.warenform.de/nd-archiv-common.yml index 01c26e8..469f957 100644 --- a/host_vars/nd-archiv.warenform.de/nd-archiv-common.yml +++ b/host_vars/nd-archiv.warenform.de/nd-archiv-common.yml @@ -151,15 +151,6 @@ ssh_keypair_backup_client: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/nd-live.warenform.de/nd-live-common.yml b/host_vars/nd-live.warenform.de/nd-live-common.yml index 01c26e8..469f957 100644 --- a/host_vars/nd-live.warenform.de/nd-live-common.yml +++ b/host_vars/nd-live.warenform.de/nd-live-common.yml @@ -151,15 +151,6 @@ ssh_keypair_backup_client: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/nd.warenform.de/nd-common.yml b/host_vars/nd.warenform.de/nd-common.yml index 01c26e8..469f957 100644 --- a/host_vars/nd.warenform.de/nd-common.yml +++ b/host_vars/nd.warenform.de/nd-common.yml @@ -151,15 +151,6 @@ ssh_keypair_backup_client: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/o12.oopen.de/o12-common.yml b/host_vars/o12.oopen.de/o12-common.yml index 0c3ee2a..f307c1d 100644 --- a/host_vars/o12.oopen.de/o12-common.yml +++ b/host_vars/o12.oopen.de/o12-common.yml @@ -306,15 +306,6 @@ cron_user_entries: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/o13-cryptpad.oopen.de/o13-cryptpad-common.yml b/host_vars/o13-cryptpad.oopen.de/o13-cryptpad-common.yml index 501e6ad..4f8057e 100644 --- a/host_vars/o13-cryptpad.oopen.de/o13-cryptpad-common.yml +++ b/host_vars/o13-cryptpad.oopen.de/o13-cryptpad-common.yml @@ -149,15 +149,6 @@ sudo_users: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/o13-mail.oopen.de/o13-mail-common.yml b/host_vars/o13-mail.oopen.de/o13-mail-common.yml index 88df8a6..4422ead 100644 --- a/host_vars/o13-mail.oopen.de/o13-mail-common.yml +++ b/host_vars/o13-mail.oopen.de/o13-mail-common.yml @@ -153,15 +153,6 @@ sudo_users: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/o13-mumble.oopen.de/o13-mumble-common.yml b/host_vars/o13-mumble.oopen.de/o13-mumble-common.yml index 501e6ad..4f8057e 100644 --- a/host_vars/o13-mumble.oopen.de/o13-mumble-common.yml +++ b/host_vars/o13-mumble.oopen.de/o13-mumble-common.yml @@ -149,15 +149,6 @@ sudo_users: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/o13-pad.oopen.de/o13-pad-common.yml b/host_vars/o13-pad.oopen.de/o13-pad-common.yml index 501e6ad..4f8057e 100644 --- a/host_vars/o13-pad.oopen.de/o13-pad-common.yml +++ b/host_vars/o13-pad.oopen.de/o13-pad-common.yml @@ -149,15 +149,6 @@ sudo_users: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/o13-staging-board.oopen.de/o13-staging-board-common.yml b/host_vars/o13-staging-board.oopen.de/o13-staging-board-common.yml index eba02a5..7ddcc02 100644 --- a/host_vars/o13-staging-board.oopen.de/o13-staging-board-common.yml +++ b/host_vars/o13-staging-board.oopen.de/o13-staging-board-common.yml @@ -155,15 +155,6 @@ sudo_users: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/o13-web.oopen.de/o13-web-common.yml b/host_vars/o13-web.oopen.de/o13-web-common.yml index 501e6ad..4f8057e 100644 --- a/host_vars/o13-web.oopen.de/o13-web-common.yml +++ b/host_vars/o13-web.oopen.de/o13-web-common.yml @@ -149,15 +149,6 @@ sudo_users: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/o13.oopen.de/o13-common.yml b/host_vars/o13.oopen.de/o13-common.yml index 8c8971c..019d0f5 100644 --- a/host_vars/o13.oopen.de/o13-common.yml +++ b/host_vars/o13.oopen.de/o13-common.yml @@ -234,15 +234,6 @@ sudo_users: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/o17.oopen.de/o17-common.yml b/host_vars/o17.oopen.de/o17-common.yml index 823cbe2..99fb5e2 100644 --- a/host_vars/o17.oopen.de/o17-common.yml +++ b/host_vars/o17.oopen.de/o17-common.yml @@ -311,15 +311,6 @@ cron_user_entries: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # --- # vars used by roles/common/tasks/samba-config-server.yml diff --git a/host_vars/o18.oopen.de/o18-common.yml b/host_vars/o18.oopen.de/o18-common.yml index dc7aace..360328b 100644 --- a/host_vars/o18.oopen.de/o18-common.yml +++ b/host_vars/o18.oopen.de/o18-common.yml @@ -302,15 +302,6 @@ cron_user_entries: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/o19.oopen.de/o19-common.yml b/host_vars/o19.oopen.de/o19-common.yml index f8e4491..81886bf 100644 --- a/host_vars/o19.oopen.de/o19-common.yml +++ b/host_vars/o19.oopen.de/o19-common.yml @@ -306,15 +306,6 @@ cron_user_entries: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/o20.oopen.de/o20-common.yml b/host_vars/o20.oopen.de/o20-common.yml index 3fe944b..005df94 100644 --- a/host_vars/o20.oopen.de/o20-common.yml +++ b/host_vars/o20.oopen.de/o20-common.yml @@ -203,15 +203,6 @@ cron_user_entries: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/o21.oopen.de/o21-common.yml b/host_vars/o21.oopen.de/o21-common.yml index 243b0a3..b6984ce 100644 --- a/host_vars/o21.oopen.de/o21-common.yml +++ b/host_vars/o21.oopen.de/o21-common.yml @@ -337,15 +337,6 @@ cron_user_entries: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/o22.oopen.de/o22-common.yml b/host_vars/o22.oopen.de/o22-common.yml index 24a44e6..84fe731 100644 --- a/host_vars/o22.oopen.de/o22-common.yml +++ b/host_vars/o22.oopen.de/o22-common.yml @@ -314,15 +314,6 @@ cron_user_entries: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/o23.oopen.de/o23-common.yml b/host_vars/o23.oopen.de/o23-common.yml index f2060f7..377ec83 100644 --- a/host_vars/o23.oopen.de/o23-common.yml +++ b/host_vars/o23.oopen.de/o23-common.yml @@ -315,15 +315,6 @@ cron_user_entries: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/o24.oopen.de/o24-common.yml b/host_vars/o24.oopen.de/o24-common.yml index 47996b3..357db86 100644 --- a/host_vars/o24.oopen.de/o24-common.yml +++ b/host_vars/o24.oopen.de/o24-common.yml @@ -312,15 +312,6 @@ cron_user_entries: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/o25.oopen.de/o25-common.yml b/host_vars/o25.oopen.de/o25-common.yml index 9f5e5ab..abd0642 100644 --- a/host_vars/o25.oopen.de/o25-common.yml +++ b/host_vars/o25.oopen.de/o25-common.yml @@ -428,15 +428,6 @@ cron_user_entries: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/o26.oopen.de/o26-common.yml b/host_vars/o26.oopen.de/o26-common.yml index ebdbc88..08ed184 100644 --- a/host_vars/o26.oopen.de/o26-common.yml +++ b/host_vars/o26.oopen.de/o26-common.yml @@ -531,15 +531,6 @@ sudo_users: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/o27.oopen.de/o27-common.yml b/host_vars/o27.oopen.de/o27-common.yml index fc44268..60a258c 100644 --- a/host_vars/o27.oopen.de/o27-common.yml +++ b/host_vars/o27.oopen.de/o27-common.yml @@ -312,15 +312,6 @@ cron_user_entries: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/o28.oopen.de/o28-common.yml b/host_vars/o28.oopen.de/o28-common.yml index 85f4612..c30992f 100644 --- a/host_vars/o28.oopen.de/o28-common.yml +++ b/host_vars/o28.oopen.de/o28-common.yml @@ -297,15 +297,6 @@ cron_user_entries: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/o29.oopen.de/o29-common.yml b/host_vars/o29.oopen.de/o29-common.yml index 42c31d2..b05c830 100644 --- a/host_vars/o29.oopen.de/o29-common.yml +++ b/host_vars/o29.oopen.de/o29-common.yml @@ -307,15 +307,6 @@ cron_user_entries: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/o30.oopen.de/o30-common.yml b/host_vars/o30.oopen.de/o30-common.yml index 805a8df..ed25441 100644 --- a/host_vars/o30.oopen.de/o30-common.yml +++ b/host_vars/o30.oopen.de/o30-common.yml @@ -303,15 +303,6 @@ cron_user_entries: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/o31.oopen.de/o31-common.yml b/host_vars/o31.oopen.de/o31-common.yml index 5846758..4f11384 100644 --- a/host_vars/o31.oopen.de/o31-common.yml +++ b/host_vars/o31.oopen.de/o31-common.yml @@ -315,15 +315,6 @@ cron_user_entries: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/o32.oopen.de/o32-common.yml b/host_vars/o32.oopen.de/o32-common.yml index a4beeac..7bc6ac2 100644 --- a/host_vars/o32.oopen.de/o32-common.yml +++ b/host_vars/o32.oopen.de/o32-common.yml @@ -362,15 +362,6 @@ sudoers_file_user_privileges: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/o34.oopen.de/o34-common.yml b/host_vars/o34.oopen.de/o34-common.yml index 10adf7f..be50780 100644 --- a/host_vars/o34.oopen.de/o34-common.yml +++ b/host_vars/o34.oopen.de/o34-common.yml @@ -353,15 +353,6 @@ sudoers_file_user_privileges: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/o35.oopen.de/o35-common.yml b/host_vars/o35.oopen.de/o35-common.yml index 856223d..83fd917 100644 --- a/host_vars/o35.oopen.de/o35-common.yml +++ b/host_vars/o35.oopen.de/o35-common.yml @@ -307,15 +307,6 @@ cron_user_entries: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/o36.oopen.de/o36-common.yml b/host_vars/o36.oopen.de/o36-common.yml index 358109c..90d6a66 100644 --- a/host_vars/o36.oopen.de/o36-common.yml +++ b/host_vars/o36.oopen.de/o36-common.yml @@ -305,15 +305,6 @@ cron_user_entries: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/o38.oopen.de/o38-common.yml b/host_vars/o38.oopen.de/o38-common.yml index 2eedb3b..4b31e99 100644 --- a/host_vars/o38.oopen.de/o38-common.yml +++ b/host_vars/o38.oopen.de/o38-common.yml @@ -306,15 +306,6 @@ cron_user_entries: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/o39.oopen.de/o39-common.yml b/host_vars/o39.oopen.de/o39-common.yml index 029db5c..e129455 100644 --- a/host_vars/o39.oopen.de/o39-common.yml +++ b/host_vars/o39.oopen.de/o39-common.yml @@ -302,15 +302,6 @@ cron_user_entries: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/o40.oopen.de/o40-common.yml b/host_vars/o40.oopen.de/o40-common.yml index 75914f2..92c2754 100644 --- a/host_vars/o40.oopen.de/o40-common.yml +++ b/host_vars/o40.oopen.de/o40-common.yml @@ -307,15 +307,6 @@ cron_user_entries: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/o41.oopen.de/o41-common.yml b/host_vars/o41.oopen.de/o41-common.yml index 5cf4cd8..036720e 100644 --- a/host_vars/o41.oopen.de/o41-common.yml +++ b/host_vars/o41.oopen.de/o41-common.yml @@ -184,15 +184,6 @@ cron_user_entries: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/o42.oopen.de/o42-common.yml b/host_vars/o42.oopen.de/o42-common.yml index d9bf1ff..4581ad3 100644 --- a/host_vars/o42.oopen.de/o42-common.yml +++ b/host_vars/o42.oopen.de/o42-common.yml @@ -302,15 +302,6 @@ cron_user_entries: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/o43.oopen.de/o43-common.yml b/host_vars/o43.oopen.de/o43-common.yml index 59fedaf..35b0473 100644 --- a/host_vars/o43.oopen.de/o43-common.yml +++ b/host_vars/o43.oopen.de/o43-common.yml @@ -394,15 +394,6 @@ cron_user_entries: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/o44.oopen.de/o44-common.yml b/host_vars/o44.oopen.de/o44-common.yml index 4b52962..08544a0 100644 --- a/host_vars/o44.oopen.de/o44-common.yml +++ b/host_vars/o44.oopen.de/o44-common.yml @@ -306,15 +306,6 @@ cron_user_entries: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/o45.oopen.de/o45-common.yml b/host_vars/o45.oopen.de/o45-common.yml index 7956449..fe11f58 100644 --- a/host_vars/o45.oopen.de/o45-common.yml +++ b/host_vars/o45.oopen.de/o45-common.yml @@ -307,15 +307,6 @@ cron_user_entries: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/oolm-web.oopen.de/oolm-web-common.yml b/host_vars/oolm-web.oopen.de/oolm-web-common.yml index 5cfff9c..61f6025 100644 --- a/host_vars/oolm-web.oopen.de/oolm-web-common.yml +++ b/host_vars/oolm-web.oopen.de/oolm-web-common.yml @@ -123,15 +123,6 @@ resolved_fallback_nameserver: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/piwik.warenform.de/piwik-common.yml b/host_vars/piwik.warenform.de/piwik-common.yml index 507c04e..5618695 100644 --- a/host_vars/piwik.warenform.de/piwik-common.yml +++ b/host_vars/piwik.warenform.de/piwik-common.yml @@ -162,15 +162,6 @@ ssh_keypair_backup_client: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/prometheus-nd.oopen.de/prometheus-nd-common.yml b/host_vars/prometheus-nd.oopen.de/prometheus-nd-common.yml index aed7fbf..fa3b5af 100644 --- a/host_vars/prometheus-nd.oopen.de/prometheus-nd-common.yml +++ b/host_vars/prometheus-nd.oopen.de/prometheus-nd-common.yml @@ -187,15 +187,6 @@ sudo_users: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/server18.warenform.de/server18-common.yml b/host_vars/server18.warenform.de/server18-common.yml index e3574b8..e6cd68d 100644 --- a/host_vars/server18.warenform.de/server18-common.yml +++ b/host_vars/server18.warenform.de/server18-common.yml @@ -334,15 +334,6 @@ copy_plain_files: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/server22.warenform.de/server22-common.yml b/host_vars/server22.warenform.de/server22-common.yml index f070303..8e34522 100644 --- a/host_vars/server22.warenform.de/server22-common.yml +++ b/host_vars/server22.warenform.de/server22-common.yml @@ -321,15 +321,6 @@ copy_plain_files: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/server23.warenform.de/server23-common.yml b/host_vars/server23.warenform.de/server23-common.yml index 64775cd..bc28799 100644 --- a/host_vars/server23.warenform.de/server23-common.yml +++ b/host_vars/server23.warenform.de/server23-common.yml @@ -326,15 +326,6 @@ copy_plain_files: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/server24.warenform.de/server24-common.yml b/host_vars/server24.warenform.de/server24-common.yml index 09bbbc0..c4ddde4 100644 --- a/host_vars/server24.warenform.de/server24-common.yml +++ b/host_vars/server24.warenform.de/server24-common.yml @@ -329,15 +329,6 @@ copy_plain_files: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/server25.warenform.de/server25-common.yml b/host_vars/server25.warenform.de/server25-common.yml index 8c3d0be..97b634c 100644 --- a/host_vars/server25.warenform.de/server25-common.yml +++ b/host_vars/server25.warenform.de/server25-common.yml @@ -330,15 +330,6 @@ copy_plain_files: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/server26.warenform.de/server26-common.yml b/host_vars/server26.warenform.de/server26-common.yml index e12b40c..bc306a1 100644 --- a/host_vars/server26.warenform.de/server26-common.yml +++ b/host_vars/server26.warenform.de/server26-common.yml @@ -345,15 +345,6 @@ copy_plain_files: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/server27.warenform.de/server27-common.yml b/host_vars/server27.warenform.de/server27-common.yml index 270a782..fa855d6 100644 --- a/host_vars/server27.warenform.de/server27-common.yml +++ b/host_vars/server27.warenform.de/server27-common.yml @@ -352,15 +352,6 @@ copy_plain_files: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/verdi-django.warenform.de/verdi-django-common.yml b/host_vars/verdi-django.warenform.de/verdi-django-common.yml index bc4ca54..fd931b2 100644 --- a/host_vars/verdi-django.warenform.de/verdi-django-common.yml +++ b/host_vars/verdi-django.warenform.de/verdi-django-common.yml @@ -142,15 +142,6 @@ resolved_fallback_nameserver: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/vvn-shop.warenform.de/vvn-shop-common.yml b/host_vars/vvn-shop.warenform.de/vvn-shop-common.yml index 474f5d2..10432fe 100644 --- a/host_vars/vvn-shop.warenform.de/vvn-shop-common.yml +++ b/host_vars/vvn-shop.warenform.de/vvn-shop-common.yml @@ -146,15 +146,6 @@ ssh_keypair_backup_client: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/vvn-www.warenform.de/vvn-www-common.yml b/host_vars/vvn-www.warenform.de/vvn-www-common.yml index e4d6d08..8022610 100644 --- a/host_vars/vvn-www.warenform.de/vvn-www-common.yml +++ b/host_vars/vvn-www.warenform.de/vvn-www-common.yml @@ -145,15 +145,6 @@ ssh_keypair_backup_client: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/web-01.oopen.de/web-01-common.yml b/host_vars/web-01.oopen.de/web-01-common.yml index 3dfa779..9036caa 100644 --- a/host_vars/web-01.oopen.de/web-01-common.yml +++ b/host_vars/web-01.oopen.de/web-01-common.yml @@ -127,15 +127,6 @@ resolved_fallback_nameserver: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/web-02.oopen.de/web-02-common.yml b/host_vars/web-02.oopen.de/web-02-common.yml index 3dfa779..9036caa 100644 --- a/host_vars/web-02.oopen.de/web-02-common.yml +++ b/host_vars/web-02.oopen.de/web-02-common.yml @@ -127,15 +127,6 @@ resolved_fallback_nameserver: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/web-03.oopen.de/web-03-common.yml b/host_vars/web-03.oopen.de/web-03-common.yml index 3dfa779..9036caa 100644 --- a/host_vars/web-03.oopen.de/web-03-common.yml +++ b/host_vars/web-03.oopen.de/web-03-common.yml @@ -127,15 +127,6 @@ resolved_fallback_nameserver: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/web-04.oopen.de/web-04-common.yml b/host_vars/web-04.oopen.de/web-04-common.yml index 3dfa779..9036caa 100644 --- a/host_vars/web-04.oopen.de/web-04-common.yml +++ b/host_vars/web-04.oopen.de/web-04-common.yml @@ -127,15 +127,6 @@ resolved_fallback_nameserver: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/web-05.oopen.de/web-05-common.yml b/host_vars/web-05.oopen.de/web-05-common.yml index 21462a0..6a00efa 100644 --- a/host_vars/web-05.oopen.de/web-05-common.yml +++ b/host_vars/web-05.oopen.de/web-05-common.yml @@ -125,15 +125,6 @@ resolved_fallback_nameserver: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/web-06.oopen.de/web-06-common.yml b/host_vars/web-06.oopen.de/web-06-common.yml index 21462a0..6a00efa 100644 --- a/host_vars/web-06.oopen.de/web-06-common.yml +++ b/host_vars/web-06.oopen.de/web-06-common.yml @@ -125,15 +125,6 @@ resolved_fallback_nameserver: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/web-07.oopen.de/web-07-common.yml b/host_vars/web-07.oopen.de/web-07-common.yml index 21462a0..6a00efa 100644 --- a/host_vars/web-07.oopen.de/web-07-common.yml +++ b/host_vars/web-07.oopen.de/web-07-common.yml @@ -125,15 +125,6 @@ resolved_fallback_nameserver: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/web-08.oopen.de/web-08-common.yml b/host_vars/web-08.oopen.de/web-08-common.yml index 21462a0..6a00efa 100644 --- a/host_vars/web-08.oopen.de/web-08-common.yml +++ b/host_vars/web-08.oopen.de/web-08-common.yml @@ -125,15 +125,6 @@ resolved_fallback_nameserver: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/web-09.oopen.de/web-09-common.yml b/host_vars/web-09.oopen.de/web-09-common.yml index 56c4214..9af2b54 100644 --- a/host_vars/web-09.oopen.de/web-09-common.yml +++ b/host_vars/web-09.oopen.de/web-09-common.yml @@ -127,15 +127,6 @@ resolved_fallback_nameserver: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/web-nd.oopen.de/web-nd-common.yml b/host_vars/web-nd.oopen.de/web-nd-common.yml index 6978dec..4e18d25 100644 --- a/host_vars/web-nd.oopen.de/web-nd-common.yml +++ b/host_vars/web-nd.oopen.de/web-nd-common.yml @@ -215,15 +215,6 @@ sudo_users: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/web.cadus.org/web-common.yml b/host_vars/web.cadus.org/web-common.yml index 5df1b97..cdb04aa 100644 --- a/host_vars/web.cadus.org/web-common.yml +++ b/host_vars/web.cadus.org/web-common.yml @@ -129,11 +129,6 @@ resolved_fallback_nameserver: # # see: roles/common/tasks/vars -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # --- # vars used by roles/common/tasks/copy_files.yml diff --git a/host_vars/web0.warenform.de/web0-common.yml b/host_vars/web0.warenform.de/web0-common.yml index de48dd4..4baa463 100644 --- a/host_vars/web0.warenform.de/web0-common.yml +++ b/host_vars/web0.warenform.de/web0-common.yml @@ -166,15 +166,6 @@ sudoers_file_user_privileges: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/web1.warenform.de/web1-common.yml b/host_vars/web1.warenform.de/web1-common.yml index 4991a8b..e1b176e 100644 --- a/host_vars/web1.warenform.de/web1-common.yml +++ b/host_vars/web1.warenform.de/web1-common.yml @@ -148,15 +148,6 @@ ssh_keypair_backup_client: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/host_vars/web2.warenform.de/web2-common.yml b/host_vars/web2.warenform.de/web2-common.yml index 7840787..96d152b 100644 --- a/host_vars/web2.warenform.de/web2-common.yml +++ b/host_vars/web2.warenform.de/web2-common.yml @@ -147,15 +147,6 @@ ssh_keypair_backup_client: # --- -# --- -# vars used by roles/common/tasks/git.yml -# --- - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - # ============================== diff --git a/modify-ipt-server.yml b/modify-ipt-server.yml deleted file mode 100644 index 149ff75..0000000 --- a/modify-ipt-server.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- - - -- hosts: - - oopen_server - - warenform_server - - so36_server - roles: - - modify-ipt-server diff --git a/roles/firewall/tasks/ipt-server.yml b/roles/firewall/tasks/ipt-server.yml deleted file mode 100644 index 5d3631f..0000000 --- a/roles/firewall/tasks/ipt-server.yml +++ /dev/null @@ -1,1884 +0,0 @@ ---- -# # --- -# # - Check if firewall repository exist -# # --- -# -# - name: Check if firewall repository exist -# stat: -# path: '{{ git_firewall_repository.dest }}' -# register: git_firewall_repository_exists -# -# - meta: end_host -# when: not git_firewall_repository_exists.stat.exists - -# --- -# Create firewall config directory '/etc/ipt/firewall' if not exists -# --- - -- name: Install/update firewall repository - git: - repo: '{{ git_firewall_repository.repo }}' - dest: '{{ git_firewall_repository.dest }}' - when: git_firewall_repository is defined and git_firewall_repository|length > 0 - tags: - - git-firewall-repository - -# Exit if no firewall repository variable exists or is empty -# -- meta: end_host - when: git_firewall_repository is not defined or git_firewall_repository|length < 1 - -- name: Create directory /etc/ipt-firewall if not exists - file: - path: /etc/ipt-firewall - state: directory - -# --- -# Check presence of files -# --- - -- name: Check if /etc/ipt-firewall/interfaces_ipv4.conf are present - stat: - path: /etc/ipt-firewall/interfaces_ipv4.conf - register: interfaces_ipv4_exists - -- name: Check if /etc/ipt-firewall/interfaces_ipv6.conf are present - stat: - path: /etc/ipt-firewall/interfaces_ipv6.conf - register: interfaces_ipv6_exists - -- name: Check if file '/etc/ipt-firewall/main_ipv4.conf' exists - stat: - path: /etc/ipt-firewall/main_ipv4.conf - register: main_ipv4_exists - -- name: Check if file '/etc/ipt-firewall/main_ipv6.conf' exists - stat: - path: /etc/ipt-firewall/main_ipv6.conf - register: main_ipv6_exists - -- name: Check if /etc/ipt-firewall/ban_ipv4.list are present - stat: - path: /etc/ipt-firewall/ban_ipv4.list - register: ban_ipv4_exists - -- name: Check if /etc/ipt-firewall/ban_ipv6.list are present - stat: - path: /etc/ipt-firewall/ban_ipv6.list - register: ban_ipv6_exists - -# --- -# Get information about network devices -# --- - -- name: define traditional ethernet facts - set_fact: - ansible_netdev: "{% set ansible_netdev = ansible_netdev|default([]) + [hostvars[inventory_hostname]['ansible_' + item]] %}{{ ansible_netdev|list }}" - when: - - not interfaces_ipv4_exists.stat.exists - - hostvars[inventory_hostname]['ansible_' + item]['type'] is defined - - hostvars[inventory_hostname]['ansible_' + item]['type'] == 'ether' - - inventory_hostname not in groups['lxc_host']|string - with_items: - - "{{ hostvars[inventory_hostname]['ansible_interfaces'] }}" - -- name: define traditional bridge facts - set_fact: - ansible_netdev: "{% set ansible_netdev = ansible_netdev|default([]) + [hostvars[inventory_hostname]['ansible_' + item]] %}{{ ansible_netdev|list }}" - when: - - not interfaces_ipv4_exists.stat.exists - - hostvars[inventory_hostname]['ansible_' + item]['type'] is defined - - hostvars[inventory_hostname]['ansible_' + item]['type'] == 'bridge' - - "groups['lxc_host']|string is search(inventory_hostname)" - with_items: - - "{{ hostvars[inventory_hostname]['ansible_interfaces'] }}" - -- name: Debug message IPv4 - debug: - msg: - - "index: {{ idx + 1 }}" - - "device: {{ item.device }}" - - "ipv4-address: {{ item.ipv4.address }}" - loop: "{{ ansible_netdev }}" - loop_control: - label: "{{ item.device }}" - index_var: idx - when: - - item.ipv4.address is defined and item.ipv4.address|length > 0 - -- name: Debug message IPv6 - debug: - msg: - - "index: {{ idx + 1 }}" - - "device: {{ item.device }}" - - "ipv6-address: {{ item.ipv6.0.address }}{{ (item.ipv6.1.address is match 'f.*') | ternary('', ' ' + item.ipv6.1.address) }}" - loop: "{{ ansible_netdev }}" - loop_control: - label: "{{ item.device }}" - index_var: idx - when: - - item.default_ipv6 is defined and item.default_ipv6|length > 0 - - item.ipv6.0.address is defined and item.ipv6.0.address|length > 0 - -#- meta: end_host - -# --- -# Get sshd ports -# --- - -- name: Get sshd ports as blank separated list - set_fact: - fw_sshd_ports: "{{ sshd_ports | join (' ') }}" - when: - - sshd_ports is defined and sshd_ports | length > 0 - - sshd_ports|join() != "22" - -- name: Set default sshd ports - set_fact: - fw_sshd_ports: "$standard_ssh_port" - when: - - sshd_ports is not defined or sshd_ports | length == 0 or sshd_ports|join() == "22" - -# === -# Modify main_ipv[4|].conf - add port definitionios -# === - -# --- -# Allow local Services from given (extern) network -# --- - -- name: Check if String 'allow_local_service_from_networks=..' is present - shell: grep -q -E "^allow_local_service_from_networks=" /etc/ipt-firewall/main_ipv4.conf - register: allow_local_service_from_networks_ipv4_present - when: main_ipv4_exists.stat.exists - failed_when: "allow_local_service_from_networks_ipv4_present.rc > 1" - changed_when: "allow_local_service_from_networks_ipv4_present.rc > 0" - -- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (allow_local_service_from_networks) - blockinfile: - path: /etc/ipt-firewall/main_ipv4.conf - insertafter: '^#?\s*allow_local_service' - block: | - - # ------------- - # ---- Allow local Services from given (extern) network - # ------------- - - # - allow_local_service_from_networks - # - - # - allow_local_service_from_networks=" [: [.." - # - - # - Allow all traffic to given local service from given (extern) network - # - - # - Example: - # - allow_local_service="192.68.11.64/27:8443:tcp 192.68.11.64/27:8080:tcp" - # - - # - Blank separated list - # - - allow_local_service_from_networks="" - marker: "# Marker set by modify-ipt-server.yml (allow_local_service_from_networks)" - when: - - main_ipv4_exists.stat.exists - - allow_local_service_from_networks_ipv4_present is changed - notify: - - Restart IPv4 Firewall - -- name: Check if String 'allow_local_service_from_networks=..' is present - shell: grep -q -E "^allow_local_service_from_networks=" /etc/ipt-firewall/main_ipv6.conf - register: allow_local_service_from_networks_ipv6_present - when: main_ipv6_exists.stat.exists - failed_when: "allow_local_service_from_networks_ipv6_present.rc > 1" - changed_when: "allow_local_service_from_networks_ipv6_present.rc > 0" - -- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (allow_local_service_from_networks) - blockinfile: - path: /etc/ipt-firewall/main_ipv6.conf - insertafter: '^#?\s*allow_local_service' - block: | - - # ------------- - # ---- Allow local Services from given (extern) network - # ------------- - - # - allow_local_service_from_networks - # - - # - allow_local_service_from_networks=" [, [.." - # - - # - Allow all traffic to given local service from given (extern) network - # - - # - Example: - # - allow_local_service="2001:678:a40:3000::/64,8443,tcp 2001:678:a40:3000::/64,8080,tcp" - # - - # - Blank separated list - # - - allow_local_service_from_networks="" - marker: "# Marker set by modify-ipt-server.yml (allow_local_service_from_networks)" - when: - - main_ipv6_exists.stat.exists - - allow_local_service_from_networks_ipv6_present is changed - notify: - - Restart IPv6 Firewall - - -# --- -# vpn_ports -# --- - -- name: Check if String 'vpn_ports=..' is present - shell: grep -q -E "^vpn_ports=" /etc/ipt-firewall/main_ipv4.conf - register: vpn_ports_ipv4_present - when: main_ipv4_exists.stat.exists - failed_when: "vpn_ports_ipv4_present.rc > 1" - changed_when: "vpn_ports_ipv4_present.rc > 0" - -- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (vpn_ports) - blockinfile: - path: /etc/ipt-firewall/main_ipv4.conf - insertafter: '^#?\s*forward_vpn_server_ips' - block: | - # - VPN Port(s) used by local Services - # - - # - blank separated list - # - - vpn_ports="$standard_vpn_port" - - marker: "# Marker set by modify-ipt-server.yml (vpn_ports)" - when: - - main_ipv4_exists.stat.exists - - vpn_ports_ipv4_present is changed - notify: - - Restart IPv4 Firewall - -- name: Check if String 'vpn_ports=..' is present - shell: grep -q -E "^vpn_ports=" /etc/ipt-firewall/main_ipv6.conf - register: vpn_ports_ipv6_present - when: main_ipv6_exists.stat.exists - failed_when: "vpn_ports_ipv6_present.rc > 1" - changed_when: "vpn_ports_ipv6_present.rc > 0" - -- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (vpn_ports) - blockinfile: - path: /etc/ipt-firewall/main_ipv6.conf - insertafter: '^#?\s*forward_vpn_server_ips' - block: | - # - VPN Port(s) used by local Services - # - - # - blank separated list - # - - vpn_ports="$standard_vpn_port" - - marker: "# Marker set by modify-ipt-server.yml (vpn_ports)" - when: - - main_ipv6_exists.stat.exists - - vpn_ports_ipv6_present is changed - notify: - - Restart IPv6 Firewall - -# --- -# support local NTP Service -# --- - -- name: Check if String 'local_ntp_service..' is present - shell: grep -q -E "^local_ntp_service" /etc/ipt-firewall/main_ipv4.conf - register: local_ntp_service_ipv4_present - when: main_ipv4_exists.stat.exists - failed_when: "local_ntp_service_ipv4_present.rc > 1" - changed_when: "local_ntp_service_ipv4_present.rc > 0" - -- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (local_ntp_service) - blockinfile: - path: /etc/ipt-firewall/main_ipv4.conf - insertafter: '^#?\s*vpn_ports' - block: | - # local NTP Server - # - local_ntp_service=false - - # NPT Port used by local service - # - ntp_port="$standard_ntp_port" - - # Network allowed for NTP requests - # - # Note: if not set no port will be open! - # - ntp_allowed_net="" - marker: "# Marker set by modify-ipt-server.yml (local_ntp_service)" - when: - - main_ipv4_exists.stat.exists - - local_ntp_service_ipv4_present is changed - notify: - - Restart IPv4 Firewall - -- name: Check if String 'local_ntp_service..' is present - shell: grep -q -E "^local_ntp_service" /etc/ipt-firewall/main_ipv6.conf - register: local_ntp_service_ipv6_present - when: main_ipv6_exists.stat.exists - failed_when: "local_ntp_service_ipv6_present.rc > 1" - changed_when: "local_ntp_service_ipv6_present.rc > 0" - -- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (local_ntp_service) - blockinfile: - path: /etc/ipt-firewall/main_ipv6.conf - insertafter: '^#?\s*vpn_ports' - block: | - # local NTP Server - # - local_ntp_service=false - - # NPT Port used by local service - # - ntp_port="$standard_ntp_port" - - # Network allowed for NTP requests - # - # Note: if not set no port will be open! - # - ntp_allowed_net="" - marker: "# Marker set by modify-ipt-server.yml (local_ntp_service)" - when: - - main_ipv6_exists.stat.exists - - local_ntp_service_ipv6_present is changed - notify: - - Restart IPv6 Firewall - -# --- -# support local DNS Resolver -# --- - -- name: Check if String 'local_resolver_service..' is present - shell: grep -q -E "^local_resolver_service" /etc/ipt-firewall/main_ipv4.conf - register: local_resolver_service_ipv4_present - when: main_ipv4_exists.stat.exists - failed_when: "local_resolver_service_ipv4_present.rc > 1" - changed_when: "local_resolver_service_ipv4_present.rc > 0" - -- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (local_resolver_service) - blockinfile: - path: /etc/ipt-firewall/main_ipv4.conf - insertafter: '^#?\s*forward_dns_server_ips' - block: | - # - local DNS Resolver - # - - local_resolver_service=false - - # - Resolover Port used by local service - # - - resolver_port="$standard_dns_port" - - # - Network allowed for DNS requests - # - - # - Note: if not set no port will be open! - # - - # - Example: - # - resolver_allowed_networks="192.68.11.64/27 194.150.169.139" - # - - resolver_allowed_networks="" - - marker: "# Marker set by modify-ipt-server.yml (local_resolver_service)" - when: - - main_ipv4_exists.stat.exists - - local_resolver_service_ipv4_present is changed - notify: - - Restart IPv4 Firewall - -- name: Check if String 'local_resolver_service..' is present - shell: grep -q -E "^local_resolver_service" /etc/ipt-firewall/main_ipv6.conf - register: local_resolver_service_ipv6_present - when: main_ipv6_exists.stat.exists - failed_when: "local_resolver_service_ipv6_present.rc > 1" - changed_when: "local_resolver_service_ipv6_present.rc > 0" - -- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (local_resolver_service) - blockinfile: - path: /etc/ipt-firewall/main_ipv6.conf - insertafter: '^#?\s*forward_dns_server_ips' - block: | - # - local DNS Resolver - # - - local_resolver_service=false - - # - Resolover Port used by local service - # - - resolver_port="$standard_dns_port" - - # - Network allowed for DNS requests - # - - # - Note: if not set no port will be open! - # - - # - Example: - # - resolver_allowed_net="2001:678:a40:3000::/64 2001:678:a40:4000::/64" - # - - resolver_allowed_networks="" - - marker: "# Marker set by modify-ipt-server.yml (local_resolver_service)" - when: - - main_ipv6_exists.stat.exists - - local_resolver_service_ipv6_present is changed - notify: - - Restart IPv6 Firewall - -# --- -# ssh_ports -# --- - -- name: Check if String 'ssh_ports=..' is present - shell: grep -q -E "^ssh_ports=" /etc/ipt-firewall/main_ipv4.conf - register: ssh_ports_ipv4_present - when: main_ipv4_exists.stat.exists - failed_when: "ssh_ports_ipv4_present.rc > 1" - changed_when: "ssh_ports_ipv4_present.rc > 0" - -- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (ssh_ports) - blockinfile: - path: /etc/ipt-firewall/main_ipv4.conf - insertafter: '^#?\s*forward_ssh_server_ips' - block: | - # - SSH Port(s) used by local Services - # - - # - blank separated list - # - - ssh_ports="{{ fw_sshd_ports }}" - - marker: "# Marker set by modify-ipt-server.yml (ssh_ports)" - when: - - main_ipv4_exists.stat.exists - - ssh_ports_ipv4_present is changed - notify: - - Restart IPv4 Firewall - -- name: Check if String 'ssh_ports=..' is present - shell: grep -q -E "^ssh_ports=" /etc/ipt-firewall/main_ipv6.conf - register: ssh_ports_ipv6_present - when: main_ipv6_exists.stat.exists - failed_when: "ssh_ports_ipv6_present.rc > 1" - changed_when: "ssh_ports_ipv6_present.rc > 0" - -- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (ssh_ports) - blockinfile: - path: /etc/ipt-firewall/main_ipv6.conf - insertafter: '^#?\s*forward_ssh_server_ips' - block: | - # - SSH Port(s) used by local Services - # - - # - blank separated list - # - - ssh_ports="{{ fw_sshd_ports }}" - - marker: "# Marker set by modify-ipt-server.yml (ssh_ports)" - when: - - main_ipv6_exists.stat.exists - - ssh_ports_ipv6_present is changed - notify: - - Restart IPv6 Firewall - -# --- -# http_ports -# --- - -- name: Check if String 'http_ports=..' is present - shell: grep -q -E "^http_ports=" /etc/ipt-firewall/main_ipv4.conf - register: http_ports_ipv4_present - when: main_ipv4_exists.stat.exists - failed_when: "http_ports_ipv4_present.rc > 1" - changed_when: "http_ports_ipv4_present.rc > 0" - -- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (http_ports) - blockinfile: - path: /etc/ipt-firewall/main_ipv4.conf - insertafter: '^#?\s*forward_http_server_ips' - block: | - # - HTTP(S) Ports used by local Services - # - - # - comma separated list - # - - http_ports="$standard_http_ports" - - marker: "# Marker set by modify-ipt-server.yml (http_ports)" - when: - - main_ipv4_exists.stat.exists - - http_ports_ipv4_present is changed - notify: - - Restart IPv4 Firewall - -- name: Check if String 'http_ports=..' is present - shell: grep -q -E "^http_ports=" /etc/ipt-firewall/main_ipv6.conf - register: http_ports_ipv6_present - when: main_ipv4_exists.stat.exists - failed_when: "http_ports_ipv6_present.rc > 1" - changed_when: "http_ports_ipv6_present.rc > 0" - -- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (http_ports) - blockinfile: - path: /etc/ipt-firewall/main_ipv6.conf - insertafter: '^#?\s*forward_http_server_ips' - block: | - # - HTTP(S) Ports used by local Services - # - - # - comma separated list - # - - http_ports="$standard_http_ports" - - marker: "# Marker set by modify-ipt-server.yml (http_ports)" - when: - - main_ipv6_exists.stat.exists - - http_ports_ipv6_present is changed - notify: - - Restart IPv6 Firewall - -# --- -# mail_user_ports -# --- - -- name: Check if String 'mail_user_ports=..' is present - shell: grep -q -E "^mail_user_ports=" /etc/ipt-firewall/main_ipv4.conf - register: mail_user_ports_ipv4_present - when: main_ipv4_exists.stat.exists - failed_when: "mail_user_ports_ipv4_present.rc > 1" - changed_when: "mail_user_ports_ipv4_present.rc > 0" - -- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (mail_user_ports) - blockinfile: - path: /etc/ipt-firewall/main_ipv4.conf - insertafter: '^#?\s*forward_mail_server_ips' - block: | - # - Client Ports used by local Mail Services - # - - # - comma separated list - # - - mail_user_ports="$standard_mailuser_ports" - - marker: "# Marker set by modify-ipt-server.yml (mail_user_ports)" - when: - - main_ipv4_exists.stat.exists - - mail_user_ports_ipv4_present is changed - notify: - - Restart IPv4 Firewall - -- name: Check if String 'mail_user_ports=..' is present - shell: grep -q -E "^mail_user_ports=" /etc/ipt-firewall/main_ipv6.conf - register: mail_user_ports_ipv6_present - when: main_ipv4_exists.stat.exists - failed_when: "mail_user_ports_ipv6_present.rc > 1" - changed_when: "mail_user_ports_ipv6_present.rc > 0" - -- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (mail_user_ports) - blockinfile: - path: /etc/ipt-firewall/main_ipv6.conf - insertafter: '^#?\s*forward_mail_server_ips' - block: | - # - Client Ports used by local Mail Services - # - - # - comma separated list - # - - mail_user_ports="$standard_mailuser_ports" - - marker: "# Marker set by modify-ipt-server.yml (mail_user_ports)" - when: - - main_ipv6_exists.stat.exists - - mail_user_ports_ipv6_present is changed - notify: - - Restart IPv6 Firewall - -# --- -# dovecot_auth_service -# --- - -- name: Check if String 'dovecot_auth_service=..' is present - shell: grep -q -E "^dovecot_auth_service=" /etc/ipt-firewall/main_ipv4.conf - register: dovecot_auth_service_ipv4_present - when: main_ipv4_exists.stat.exists - failed_when: "dovecot_auth_service_ipv4_present.rc > 1" - changed_when: "dovecot_auth_service_ipv4_present.rc > 0" - -- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (dovecot_auth_service) - blockinfile: - path: /etc/ipt-firewall/main_ipv4.conf - insertafter: '^#?\s*forward_mail_client_ips' - block: | - - # - Dovecot auth service - # - - dovecot_auth_service=false - - # - Port listen for dovecot auth requests - # - - dovecot_auth_port=44444 - - # - Client Network(s) allowed to connect to dovecot's auth service - # - - # - Example: - # - dovecot_auth_allowed_networks="192.68.11.64/27 194.150.169.139" - # - - dovecot_auth_allowed_networks="" - marker: "# Marker set by modify-ipt-server.yml (dovecot_auth_service)" - when: - - main_ipv4_exists.stat.exists - - dovecot_auth_service_ipv4_present is changed - notify: - - Restart IPv4 Firewall - -- name: Check if String 'dovecot_auth_service=..' is present - shell: grep -q -E "^dovecot_auth_service=" /etc/ipt-firewall/main_ipv6.conf - register: dovecot_auth_service_ipv6_present - when: main_ipv6_exists.stat.exists - failed_when: "dovecot_auth_service_ipv6_present.rc > 1" - changed_when: "dovecot_auth_service_ipv6_present.rc > 0" - -- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (dovecot_auth_service) - blockinfile: - path: /etc/ipt-firewall/main_ipv6.conf - insertafter: '^#?\s*forward_mail_client_ips' - block: | - - # - (local) Dovecot auth service - # - - dovecot_auth_service=false - - # - Port listen for dovecot auth requests - # - - dovecot_auth_port=44444 - - # - Client Network(s) allowed to connect to dovecot's auth service - # - - # - Example: - # - dovecot_auth_allowed_networks="2001:678:a40:3000::/64 2a01:30:0:13:2f7:50ff:fed2:cef7" - # - - dovecot_auth_allowed_networks="" - marker: "# Marker set by modify-ipt-server.yml (dovecot_auth_service)" - when: - - main_ipv6_exists.stat.exists - - dovecot_auth_service_ipv6_present is changed - notify: - - Restart IPv6 Firewall - -# --- -# ftp_passive_port_range -# --- - -- name: Check if String 'ftp_passive_port_range=..' is present - shell: grep -q -E "^ftp_passive_port_range=" /etc/ipt-firewall/main_ipv4.conf - register: ftp_passive_port_range_ipv4_present - when: main_ipv4_exists.stat.exists - failed_when: "ftp_passive_port_range_ipv4_present.rc > 1" - changed_when: "ftp_passive_port_range_ipv4_present.rc > 0" - -- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (ftp_passive_port_range) - blockinfile: - path: /etc/ipt-firewall/main_ipv4.conf - insertafter: '^#?\s*forward_ftp_server_ips' - block: | - # - FTP passive port range use by local ftp service(s) - # - - # - example: ftp_passive_port_range="50000:50400" - # - - ftp_passive_port_range="50000:50400" - - marker: "# Marker set by modify-ipt-server.yml (ftp_passive_port_range)" - when: - - main_ipv4_exists.stat.exists - - ftp_passive_port_range_ipv4_present is changed - notify: - - Restart IPv4 Firewall - -- name: Check if String 'ftp_passive_port_range=..' is present - shell: grep -q -E "^ftp_passive_port_range=" /etc/ipt-firewall/main_ipv6.conf - register: ftp_passive_port_range_ipv6_present - when: main_ipv4_exists.stat.exists - failed_when: "ftp_passive_port_range_ipv6_present.rc > 1" - changed_when: "ftp_passive_port_range_ipv6_present.rc > 0" - -- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (ftp_passive_port_range) - blockinfile: - path: /etc/ipt-firewall/main_ipv6.conf - insertafter: '^#?\s*forward_ftp_server_ips' - block: | - # - FTP passive port range use by local ftp service(s) - # - - # - example: ftp_passive_port_range="50000:50400" - # - - ftp_passive_port_range="50000:50400" - - marker: "# Marker set by modify-ipt-server.yml (ftp_passive_port_range)" - when: - - main_ipv6_exists.stat.exists - - ftp_passive_port_range_ipv6_present is changed - notify: - - Restart IPv6 Firewall - -# --- -# XMPP Service -# --- - -- name: Check if String 'xmpp_server_ips=..' is present - shell: grep -q -E "^xmpp_server_ips=" /etc/ipt-firewall/main_ipv4.conf - register: xmpp_server_ips_ipv4_present - when: main_ipv4_exists.stat.exists - failed_when: "xmpp_server_ips_ipv4_present.rc > 1" - changed_when: "xmpp_server_ips_ipv4_present.rc > 0" - -- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (xmpp_server_ips) - blockinfile: - path: /etc/ipt-firewall/main_ipv4.conf - insertafter: '^#?\s*ftp_passive_port_range' - block: | - - # - XMPP Service (Jabber - Prosody) - # - - xmpp_server_ips="" - forward_xmpp_server_ips="" - - # - Ports used by XMpp (Prosody) service - # - - # - 5222 eingehend, für Client-Verbindungen unverschlüsselt oder TLS-verschlüsselt - # - 5223 eingehend, für SSL-verschlüsselte Clientverbindungen (veraltet) - # - 5269 ein- und ausgehend, für Verbindungen zu anderen Servern - # - - # - WebSocket (support is provided by mod_websocket) - # - 5280 eingehend, für Client-Verbindungen über HTTP-Polling (nützlich für Webapplikationen) - # - - xmmp_tcp_in_ports="5222 5223 5269" - xmmp_tcp_out_ports="5269" - - # - XMPP Remote Dovecote Out Service - # - - # - Example: - # - xmmp_remote_out_services="192.68.11.81:44444 83.223.86.91:44444" - # - - xmmp_remote_out_services="" - - marker: "# Marker set by modify-ipt-server.yml (xmpp_server_ips)" - when: - - main_ipv4_exists.stat.exists - - xmpp_server_ips_ipv4_present is changed - notify: - - Restart IPv4 Firewall - -- name: Check if String 'xmpp_server_ips=..' is present - shell: grep -q -E "^xmpp_server_ips=" /etc/ipt-firewall/main_ipv6.conf - register: xmpp_server_ips_ipv6_present - when: main_ipv6_exists.stat.exists - failed_when: "xmpp_server_ips_ipv6_present.rc > 1" - changed_when: "xmpp_server_ips_ipv6_present.rc > 0" - -- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (xmpp_server_ips) - blockinfile: - path: /etc/ipt-firewall/main_ipv6.conf - insertafter: '^#?\s*ftp_passive_port_range' - block: | - - # - XMPP Service (Jabber - Prosody) - # - - xmpp_server_ips="" - forward_xmpp_server_ips="" - - # - Ports used by XMpp (Prosody) service - # - - # - 5222 eingehend, für Client-Verbindungen unverschlüsselt oder TLS-verschlüsselt - # - 5223 eingehend, für SSL-verschlüsselte Clientverbindungen (veraltet) - # - 5269 ein- und ausgehend, für Verbindungen zu anderen Servern - # - - # - WebSocket (support is provided by mod_websocket) - # - 5280 eingehend, für Client-Verbindungen über HTTP-Polling (nützlich für Webapplikationen) - # - - xmmp_tcp_in_ports="5222 5223 5269" - xmmp_tcp_out_ports="5269" - - # - XMPP Remote Dovecote Out Service - # - - # - Example: - # - xmmp_remote_out_services=" - # - 2a01:4f8:221:3b4e::247,44444 - # - 2a01:30:0:13:2f7:50ff:fed2:cef7,44444 - # - " - # - - xmmp_remote_out_services="" - - marker: "# Marker set by modify-ipt-server.yml (xmpp_server_ips)" - when: - - main_ipv6_exists.stat.exists - - xmpp_server_ips_ipv6_present is changed - notify: - - Restart IPv6 Firewall - -# --- -# munin_remote_port -# --- - -- name: Check if String 'munin_remote_port=..' is present - shell: grep -q -E "^munin_remote_port=" /etc/ipt-firewall/main_ipv4.conf - register: munin_remote_port_ipv4_present - when: main_ipv4_exists.stat.exists - failed_when: "munin_remote_port_ipv4_present.rc > 1" - changed_when: "munin_remote_port_ipv4_present.rc > 0" - -- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (munin_remote_port) - blockinfile: - path: /etc/ipt-firewall/main_ipv4.conf - insertafter: '^#?\s*forward_munin_server_ips' - block: | - # - Port used by clients hosted on this (local) Munin Services - # - - # - !! Only one port is possible !! - # - - munin_remote_port="$standard_munin_port" - - marker: "# Marker set by modify-ipt-server.yml (munin_remote_port)" - when: - - main_ipv4_exists.stat.exists - - munin_remote_port_ipv4_present is changed - notify: - - Restart IPv4 Firewall - -- name: Check if String 'munin_remote_port=..' is present - shell: grep -q -E "^munin_remote_port=" /etc/ipt-firewall/main_ipv6.conf - register: munin_remote_port_ipv6_present - when: main_ipv4_exists.stat.exists - failed_when: "munin_remote_port_ipv6_present.rc > 1" - changed_when: "munin_remote_port_ipv6_present.rc > 0" - -- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (munin_remote_port) - blockinfile: - path: /etc/ipt-firewall/main_ipv6.conf - insertafter: '^#?\s*forward_munin_server_ips' - block: | - # - Ports used by clients hosted on this (local) Munin Services - # - - # - !! Only one port is possible !! - # - - munin_remote_port="$standard_munin_port" - - marker: "# Marker set by modify-ipt-server.yml (munin_remote_port)" - when: - - main_ipv6_exists.stat.exists - - munin_remote_port_ipv6_present is changed - notify: - - Restart IPv6 Firewall - -# --- -# xymon_port -# --- - -- name: Check if String 'xymon_port=..' is present - shell: grep -q -E "^xymon_port=" /etc/ipt-firewall/main_ipv4.conf - register: xymon_port_ipv4_present - when: main_ipv4_exists.stat.exists - failed_when: "xymon_port_ipv4_present.rc > 1" - changed_when: "xymon_port_ipv4_present.rc > 0" - -- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (xymon_port) - blockinfile: - path: /etc/ipt-firewall/main_ipv4.conf - insertafter: '^#?\s*local_xymon_client' - block: | - # - Port used by local Xymon Services - # - - # - !! Only one port is possible !! - # - - xymon_port="$standard_xymon_port" - - marker: "# Marker set by modify-ipt-server.yml (xymon_port)" - when: - - main_ipv4_exists.stat.exists - - xymon_port_ipv4_present is changed - notify: - - Restart IPv4 Firewall - -- name: Check if String 'xymon_port=..' is present - shell: grep -q -E "^xymon_port=" /etc/ipt-firewall/main_ipv6.conf - register: xymon_port_ipv6_present - when: main_ipv4_exists.stat.exists - failed_when: "xymon_port_ipv6_present.rc > 1" - changed_when: "xymon_port_ipv6_present.rc > 0" - -- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (xymon_port) - blockinfile: - path: /etc/ipt-firewall/main_ipv6.conf - insertafter: '^#?\s*local_xymon_client' - block: | - # - Port used by local Xymon Services - # - - # - !! Only one port is possible !! - # - - xymon_port="$standard_xymon_port" - - marker: "# Marker set by modify-ipt-server.yml (xymon_port)" - when: - - main_ipv6_exists.stat.exists - - xymon_port_ipv6_present is changed - notify: - - Restart IPv6 Firewall - -# --- -# mumble_ports -# --- - -- name: Check if String 'mumble_ports=..' is present - shell: grep -q -E "^mumble_ports=" /etc/ipt-firewall/main_ipv4.conf - register: mumble_ports_ipv4_present - when: main_ipv4_exists.stat.exists - failed_when: "mumble_ports_ipv4_present.rc > 1" - changed_when: "mumble_ports_ipv4_present.rc > 0" - -- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (mumble_ports) - blockinfile: - path: /etc/ipt-firewall/main_ipv4.conf - insertafter: '^#?\s*forward_mumble_server_ips' - block: | - # - Ports used by local Mumble Services - # - - # - comma separated list - # - - mumble_ports="$standard_mumble_port" - - marker: "# Marker set by modify-ipt-server.yml (mumble_ports)" - when: - - main_ipv4_exists.stat.exists - - mumble_ports_ipv4_present is changed - notify: - - Restart IPv4 Firewall - -- name: Check if String 'mumble_ports=..' is present - shell: grep -q -E "^mumble_ports=" /etc/ipt-firewall/main_ipv6.conf - register: mumble_ports_ipv6_present - when: main_ipv6_exists.stat.exists - failed_when: "mumble_ports_ipv6_present.rc > 1" - changed_when: "mumble_ports_ipv6_present.rc > 0" - -- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (mumble_ports) - blockinfile: - path: /etc/ipt-firewall/main_ipv6.conf - insertafter: '^#?\s*forward_mumble_server_ips' - block: | - # - Ports used by local Mumble Services - # - - # - comma separated list - # - - mumble_ports="$standard_mumble_port" - - marker: "# Marker set by modify-ipt-server.yml (mumble_ports)" - when: - - main_ipv6_exists.stat.exists - - mumble_ports_ipv6_present is changed - notify: - - Restart IPv6 Firewall - - -# --- -# Portforwarding -# --- - -- name: Check if String 'portforward_tcp=..' (IPv4) is present - shell: grep -q -E "^portforward_tcp=" /etc/ipt-firewall/main_ipv4.conf - register: portforward_tcp_ipv4_present - when: main_ipv4_exists.stat.exists - failed_when: "portforward_tcp_ipv4_present.rc > 1" - changed_when: "portforward_tcp_ipv4_present.rc > 0" - -- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (portforward_tcp) - blockinfile: - path: /etc/ipt-firewall/main_ipv4.conf - insertafter: '^#?\s*forward_udp_out_ports' - block: | - - # ============= - # --- Portforwarding - # ============= - - # - Portforwarding TCP - # - - # - portforward_tcp="::::" - # - - # - Multiple declarations (blank separated list) are possible - # - - # - Example: - # - portforward_tcp="${ext_if_1}:83.223.86.95:9997:192.168.52.25:22 - # - ${ext_if_1}:${ext_1_ip}:80:83.223.86.98:80 - # - ${ext_if_1}:${ext_1_ip}:443:83.223.86.98:443 - # - " - # - - # - Note! - # - be careful if you use a variable (e.g. ext_1_ip) that it contains NO SPACES. - # - - # - Blank separated list - # - - portforward_tcp="" - - - # - Portforwarding UDP - # - - # - portforward_udp="::::" - # - - # - Multiple declarations (blank separated list) are possible - # - - # - Example: - # - portforward_udp=" - # - ${ext_if_1}:${ext_1_ip}:1194:192.168.52.25:1194 - # - ${ext_if_1}:${ext_1_ip}:1195:192.168.53.24:1195 - # - " - # - - # - Blank separated list - # - - portforward_udp="" - - marker: "# Marker set by modify-ipt-server.yml (portforward_tcp)" - when: - - main_ipv4_exists.stat.exists - - portforward_tcp_ipv4_present is changed - notify: - - Restart IPv4 Firewall - - -- name: Check if String 'portforward_tcp=..' (IPv6) is present - shell: grep -q -E "^portforward_tcp=" /etc/ipt-firewall/main_ipv6.conf - register: portforward_tcp_ipv6_present - when: main_ipv6_exists.stat.exists - failed_when: "portforward_tcp_ipv6_present.rc > 1" - changed_when: "portforward_tcp_ipv6_present.rc > 0" - -- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (mumble_ports) - blockinfile: - path: /etc/ipt-firewall/main_ipv6.conf - insertafter: '^#?\s*forward_udp_out_ports' - block: | - - # ============= - # --- Portforwarding - # ============= - - # - Portforwarding TCP - # - - # - portforward_tcp=",,,," - # - - # - Multiple declarations (blank separated list) are possible - # - - # - Example: - # - portforward_tcp="${ext_if_1},${ext_1_ip},9997,2a01:30:0:13:5054:ff:fe83:dbda,c22 - # - ${ext_if_1},${ext_1_ip},80,2a01:30:0:13:211:84ff:feb7:7f9c,80 - # - ${ext_if_1},2a01:30:0:13:2d1:2bff:fec1:aed0,80,2a01:30:0:13:211:84ff:feb7:7f9c,80 - # - ${ext_if_1},2a01:30:0:13:2d1:2bff:fec1:aed0,443,2a01:30:0:13:211:84ff:feb7:7f9c,443 - # - " - # - - # - Note! - # - be careful if you use a variable (e.g. ext_1_ip) that it contains NO SPACES. - # - - # - Blank separated list - # - - portforward_tcp="" - - - # - Portforwarding UDP - # - - # - portforward_udp=",,,," - # - - # - Multiple declarations (blank separated list) are possible - # - - # - Example: - # - portforward_udp=" - # - ${ext_if_1},${ext_1_ip},1094,,1094 - # - ${ext_if_1},${ext_1_ip},1095,,1095 - # - " - # - - # - Blank separated list - # - - portforward_udp="" - - marker: "# Marker set by modify-ipt-server.yml (portforward_tcp)" - when: - - main_ipv6_exists.stat.exists - - portforward_tcp_ipv6_present is changed - notify: - - Restart IPv6 Firewall - - -# --- -# Remove Marker set by blockinfile -# --- - -- name: Remove marker IPv4 - replace : - path: /etc/ipt-firewall/main_ipv4.conf - regexp: "^# Marker set by modify-ipt-server.yml.*$" - replace: "" - register: marker_ipv4_removed - #failed_when: "marker_ipv4_removed.rc > 1" - #changed_when: "marker_ipv4_removed.rc < 1" - when: - - main_ipv4_exists.stat.exists - -- name: Remove marker IPv6 - replace : - path: /etc/ipt-firewall/main_ipv6.conf - regexp: "^# Marker set by modify-ipt-server.yml.*$" - replace: "" - register: marker_ipv6_removed - #failed_when: "marker_ipv6_removed.rc > 1" - #changed_when: "marker_ipv6_removed.rc < 1" - when: - - main_ipv6_exists.stat.exists - - -# === -# Update/Modify firewall -# === - -# --- -# Host specific configuration files -# --- - -# /etc/ipt-firewall/interfaces_ipv[4|6].conf -# -- name: Place new configuration file '/etc/ipt-firewall/interfaces_ipv4.conf' - command: cp {{ git_firewall_repository.dest }}/conf/interfaces_ipv4.conf.sample /etc/ipt-firewall/interfaces_ipv4.conf - when: not interfaces_ipv4_exists.stat.exists - register: new_interfaces_ipv4 - - -- name: Configure interfaces_ipv4.conf 1/2 - lineinfile: - path: /etc/ipt-firewall/interfaces_ipv4.conf - regexp: '^ext_if_1=' - line: 'ext_if_1="{{ item.device }}"' - register: interfaces_ipv4_device - loop: "{{ ansible_netdev }}" - loop_control: - label: "{{ item.device }}" - until: - - interfaces_ipv4_device is changed - when: - - not interfaces_ipv4_exists.stat.exists - - new_interfaces_ipv4 is changed - - item.ipv4.address is defined and item.ipv4.address|length > 0 - -- name: Configure interfaces_ipv4.conf 2/2 - lineinfile: - path: /etc/ipt-firewall/interfaces_ipv4.conf - regexp: '^ext_1_ip=' - line: 'ext_1_ip="{{ item.ipv4.address }}"' - register: interfaces_ipv4_ip - loop: "{{ ansible_netdev }}" - loop_control: - label: "{{ item.device }}" - until: - - interfaces_ipv4_ip is changed - when: - - not interfaces_ipv4_exists.stat.exists - - new_interfaces_ipv4 is changed - - item.ipv4.address is defined and item.ipv4.address|length > 0 - -- name: Place new configuration file '/etc/ipt-firewall/interfaces_ipv6.conf' - command: cp {{ git_firewall_repository.dest }}/conf/interfaces_ipv6.conf.sample /etc/ipt-firewall/interfaces_ipv6.conf - when: not interfaces_ipv6_exists.stat.exists - register: new_interfaces_ipv6 - -- name: Configure interfaces_ipv6.conf 1/2 - lineinfile: - path: /etc/ipt-firewall/interfaces_ipv6.conf - regexp: '^ext_if_1=' - line: 'ext_if_1="{{ item.device }}"' - register: interfaces_ipv6_device - loop: "{{ ansible_netdev }}" - loop_control: - label: "{{ item.device }}" - until: - - interfaces_ipv6_device is changed - when: - - not interfaces_ipv6_exists.stat.exists - - new_interfaces_ipv6 is changed - - item.ipv6.0.address is defined and item.ipv6.0.address|length > 0 - -- name: Configure interfaces_ipv6.conf 2/2 - lineinfile: - path: /etc/ipt-firewall/interfaces_ipv6.conf - regexp: '^ext_1_ip=' - #line: 'ext_{{ idx + 1 }}_ip="{{ item.ipv6.0.address }} {{ item.ipv6.1.address | default('') }}"' - line: "ext_1_ip=\"{{ item.ipv6.0.address }}{{ (item.ipv6.1.address is match 'f.*') | ternary('', ' ' + item.ipv6.1.address) }}\"" - register: interfaces_ipv6_ip - loop: "{{ ansible_netdev }}" - loop_control: - label: "{{ item.device }}" - until: - - interfaces_ipv6_ip is changed - when: - - not interfaces_ipv6_exists.stat.exists - - new_interfaces_ipv6 is changed - - item.ipv6.0.address is defined and item.ipv6.0.address|length > 0 - - item.ipv6.1.address is defined and item.ipv6.1.address|length > 0 - -# /etc/ipt-firewall/ban_ipv[4|6].list -# -- name: Place new configuration file '/etc/ipt-firewall/ban_ipv4.list' - command: cp {{ git_firewall_repository.dest }}/conf/ban_ipv4.list.sample /etc/ipt-firewall/ban_ipv4.list - when: not ban_ipv4_exists.stat.exists - -- name: Place new configuration file '/etc/ipt-firewall/ban_ipv6.list' - command: cp {{ git_firewall_repository.dest }}/conf/ban_ipv6.list.sample /etc/ipt-firewall/ban_ipv6.list - when: not ban_ipv6_exists.stat.exists - -# /etc/ipt-firewall/main_ipv[4|6].conf -# -- name: Place new configuration file '/etc/ipt-firewall/main_ipv4.conf' - command: cp {{ git_firewall_repository.dest }}/conf/main_ipv4.conf.sample /etc/ipt-firewall/main_ipv4.conf - when: not main_ipv4_exists.stat.exists - register: cp_main_ipv4 - -- name: Place new configuration file '/etc/ipt-firewall/main_ipv6.conf' - command: cp {{ git_firewall_repository.dest }}/conf/main_ipv6.conf.sample /etc/ipt-firewall/main_ipv6.conf - when: not main_ipv6_exists.stat.exists - register: cp_main_ipv6 - -# --- -# Configure main_ipv4.conf -# --- - -# - Firewall Bridged Traffic ? - -- name: Configure main_ipv4.conf (do_not_firewall_bridged_traffic - lxc_host) - lineinfile: - path: /etc/ipt-firewall/main_ipv4.conf - regexp: '^\s*do_not_firewall_bridged_traffic' - line: do_not_firewall_bridged_traffic=true - state: present - when: - - inventory_hostname in groups['lxc_host'] - notify: - - Restart IPv4 Firewall - -- name: Configure main_ipv4.conf (do_not_firewall_bridged_traffic - other) - lineinfile: - path: /etc/ipt-firewall/main_ipv4.conf - regexp: '^\s*do_not_firewall_bridged_traffic' - line: do_not_firewall_bridged_traffic=false - state: present - when: - - inventory_hostname not in groups['lxc_host'] - notify: - - Restart IPv4 Firewall - -# - DNS Service - -- name: Configure main_ipv4.conf (dns_server_ips) - lineinfile: - path: /etc/ipt-firewall/main_ipv4.conf - regexp: '^\s*dns_server_ips' - line: dns_server_ips="$ext_ips" - state: present - when: - - "groups['dns_server']|string is search(inventory_hostname)" - - not main_ipv4_exists.stat.exists - - cp_main_ipv4 is changed - -# - (local) Resolver - -- name: Configure main_ipv4.conf (local_resolver_service) - lineinfile: - path: /etc/ipt-firewall/main_ipv4.conf - regexp: '^\s*local_resolver_service' - line: local_resolver_service=true - state: present - when: - - "groups['local_resolver']|string is search(inventory_hostname)" - notify: - - Restart IPv4 Firewall - -- name: Configure main_ipv4.conf (resolver_allowed_networks) - lineinfile: - path: /etc/ipt-firewall/main_ipv4.conf - regexp: '^\s*resolver_allowed_networks' - line: resolver_allowed_networks="{{ (resolver_allowed_ipv4_networks | join(' ')) | default(omit) }}" - state: present - when: - - "groups['local_resolver']|string is search(inventory_hostname)" - notify: - - Restart IPv4 Firewall - -# - NTP Service - -- name: Configure main_ipv4.conf (local_ntp_service) - lineinfile: - path: /etc/ipt-firewall/main_ipv4.conf - regexp: '^\s*local_ntp_service' - line: local_ntp_service=true - state: present - when: - - "groups['ntp_server']|string is search(inventory_hostname)" - - not main_ipv4_exists.stat.exists - - cp_main_ipv4 is changed - notify: - - Restart IPv4 Firewall - -- name: Configure main_ipv4.conf (ntp_allowed_net) - lineinfile: - path: /etc/ipt-firewall/main_ipv4.conf - regexp: '^\s*local_ntp_service' - line: 'ntp_allowed_net="{{ ntp_allowed_ipv4_net | default(omit) }"' - state: present - when: - - "groups['ntp_server']|string is search(inventory_hostname)" - - not main_ipv4_exists.stat.exists - - cp_main_ipv4 is changed - notify: - - Restart IPv4 Firewall - -# - SSH Service - -- name: Configure main_ipv4.conf (ssh_server_ips) - lineinfile: - path: /etc/ipt-firewall/main_ipv4.conf - regexp: '^\s*ssh_server_ips' - line: ssh_server_ips="$ext_ips" - state: present - when: - - not main_ipv4_exists.stat.exists - - cp_main_ipv4 is changed - -# - HTTP Server - -- name: Configure main_ipv4.conf (http_server_ips) - lineinfile: - path: /etc/ipt-firewall/main_ipv4.conf - regexp: '^\s*http_server_ips=' - line: http_server_ips="$ext_1_ip" - state: present - when: - - "groups['apache2_webserver']|string is search(inventory_hostname) or - groups['nginx_webserver']|string is search(inventory_hostname)" - - not main_ipv4_exists.stat.exists - - cp_main_ipv4 is changed - -# - Mail Client Protocols - -- name: Configure main_ipv4.conf (mail_client_ips) - lineinfile: - path: /etc/ipt-firewall/main_ipv4.conf - regexp: '^\s*mail_client_ips=' - line: mail_client_ips="$ext_1_ip" - state: present - when: - - "groups['apache2_webserver']|string is search(inventory_hostname) or - groups['nginx_webserver']|string is search(inventory_hostname)" - - not main_ipv4_exists.stat.exists - - cp_main_ipv4 is changed - -# - Mal Server - -- name: Configure main_ipv4.conf (smtpd_ips) - lineinfile: - path: /etc/ipt-firewall/main_ipv4.conf - regexp: '^\s*smtpd_ips=' - line: smtpd_ips="$ext_1_ip" - state: present - when: - - "groups['mail_server']|string is search(inventory_hostname)" - - not main_ipv4_exists.stat.exists - - cp_main_ipv4 is changed - -- name: Configure main_ipv4.conf (mail_server_ips) - lineinfile: - path: /etc/ipt-firewall/main_ipv4.conf - regexp: '^\s*mail_server_ips=' - line: mail_server_ips="$ext_1_ip" - state: present - when: - - "groups['mail_server']|string is search(inventory_hostname)" - - not main_ipv4_exists.stat.exists - - cp_main_ipv4 is changed - - -# - Dovecot auth service - -- name: Configure main_ipv4.conf (dovecot_auth_service) - lineinfile: - path: /etc/ipt-firewall/main_ipv4.conf - regexp: '^\s*dovecot_auth_service=' - line: dovecot_auth_service=true - state: present - when: - - "groups['mail_server']|string is search(inventory_hostname)" - - has_dovecot_auth_service_ipv4 == true - - not main_ipv4_exists.stat.exists - - cp_main_ipv4 is changed - notify: - - Restart IPv4 Firewall - -- name: Configure main_ipv4.conf (dovecot_auth_port) - lineinfile: - path: /etc/ipt-firewall/main_ipv4.conf - regexp: '^\s*dovecot_auth_port=' - line: dovecot_auth_port={{ dovecot_auth_service_port | default(omit) }} - state: present - when: - - "groups['mail_server']|string is search(inventory_hostname)" - - has_dovecot_auth_service_ipv4 == true - - not main_ipv4_exists.stat.exists - - cp_main_ipv4 is changed - notify: - - Restart IPv4 Firewall - -- name: Configure main_ipv4.conf (dovecot_auth_allowed_networks) - lineinfile: - path: /etc/ipt-firewall/main_ipv4.conf - regexp: '^\s*dovecot_auth_allowed_networks=' - line: dovecot_auth_allowed_networks="{{ (dovecot_auth_allowed_network_ipv4 | join(' ')) | default(omit) }}" - state: present - when: - - "groups['mail_server']|string is search(inventory_hostname)" - - has_dovecot_auth_service_ipv4 == true - - not main_ipv4_exists.stat.exists - - cp_main_ipv4 is changed - notify: - - Restart IPv4 Firewall - -# - FTP Service - -- name: Configure main_ipv4.conf (ftp_server_ips) - lineinfile: - path: /etc/ipt-firewall/main_ipv4.conf - regexp: '^\s*ftp_server_ips=' - line: ftp_server_ips="$ext_1_ip" - state: present - when: - - "groups['ftp_server']|string is search(inventory_hostname)" - - not main_ipv4_exists.stat.exists - - cp_main_ipv4 is changed - -# - XMPP Service - -- name: Configure main_ipv4.conf (xmpp_server_ips) - lineinfile: - path: /etc/ipt-firewall/main_ipv4.conf - regexp: '^\s*xmpp_server_ips=' - line: xmpp_server_ips="$ext_1_ip" - state: present - when: - - "groups['xmpp_server']|string is search(inventory_hostname)" - - not main_ipv4_exists.stat.exists - - cp_main_ipv4 is changed - notify: - - Restart IPv4 Firewall - -- name: Configure main_ipv4.conf (xmmp_remote_out_services) - lineinfile: - path: /etc/ipt-firewall/main_ipv4.conf - regexp: '^\s*xmmp_remote_out_services=' - line: 'xmmp_remote_out_services="{{ xmpp_dovecot_auth_service_ipv4 | default(omit) }}"' - state: present - when: - - "groups['xmpp_server']|string is search(inventory_hostname)" - - not main_ipv4_exists.stat.exists - - cp_main_ipv4 is changed - - xmpp_has_dovecot_auth == true - notify: - - Restart IPv4 Firewall - -# - Mumble - -- name: Configure main_ipv4.conf (mumble_server_ips) - lineinfile: - path: /etc/ipt-firewall/main_ipv4.conf - regexp: '^\s*mumble_server_ips=' - line: mumble_server_ips="$ext_1_ip" - state: present - when: - - "groups['mumble_server']|string is search(inventory_hostname)" - - not main_ipv4_exists.stat.exists - - cp_main_ipv4 is changed - -# - Munin Remote IP - -- name: Configure main_ipv4.conf (munin_remote_ip) - lineinfile: - path: /etc/ipt-firewall/main_ipv4.conf - regexp: '^\s*munin_remote_ip=' - line: 'munin_remote_ip="{{ munin_remote_ipv4 }}"' - state: present - notify: - - Restart IPv4 Firewall - -# --- -# Configure main_ipv6.conf -# --- - -# - Firewall Bridged Traffic ? - -- name: Configure main_ipv6.conf (do_not_firewall_bridged_traffic - lxc_host) - lineinfile: - path: /etc/ipt-firewall/main_ipv6.conf - regexp: '^\s*do_not_firewall_bridged_traffic' - line: do_not_firewall_bridged_traffic=true - state: present - when: - - inventory_hostname in groups['lxc_host'] - notify: - - Restart IPv6 Firewall - -- name: Configure main_ipv6.conf (do_not_firewall_bridged_traffic - other) - lineinfile: - path: /etc/ipt-firewall/main_ipv6.conf - regexp: '^\s*do_not_firewall_bridged_traffic' - line: do_not_firewall_bridged_traffic=false - state: present - when: - - inventory_hostname not in groups['lxc_host'] - notify: - - Restart IPv6 Firewall - -# - DNS Service - -- name: Configure main_ipv6.conf (dns_server_ips) - lineinfile: - path: /etc/ipt-firewall/main_ipv6.conf - regexp: '^\s*dns_server_ips' - line: dns_server_ips="$ext_ips" - state: present - when: - - "groups['dns_server']|string is search(inventory_hostname)" - - not main_ipv6_exists.stat.exists - - cp_main_ipv6 is changed - notify: - - Restart IPv6 Firewall - -# - (local) Resolver - -- name: Configure main_ipv6.conf (local_resolver_service) - lineinfile: - path: /etc/ipt-firewall/main_ipv6.conf - regexp: '^\s*local_resolver_service' - line: local_resolver_service=true - state: present - when: - - "groups['local_resolver']|string is search(inventory_hostname)" - - not main_ipv6_exists.stat.exists - - cp_main_ipv6 is changed - notify: - - Restart IPv6 Firewall - -- name: Configure main_ipv6.conf (resolver_allowed_networks) - lineinfile: - path: /etc/ipt-firewall/main_ipv6.conf - regexp: '^\s*resolver_allowed_networks' - line: resolver_allowed_networks="{{ (resolver_allowed_ipv6_networks | join(' ')) | default(omit) }}" - state: present - when: - - "groups['local_resolver']|string is search(inventory_hostname)" - - not main_ipv6_exists.stat.exists - - cp_main_ipv6 is changed - notify: - - Restart IPv6 Firewall - -# - NTP Service - -- name: Configure main_ipv6.conf (local_ntp_service) - lineinfile: - path: /etc/ipt-firewall/main_ipv6.conf - regexp: '^\s*local_ntp_service' - line: local_ntp_service=true - state: present - when: - - "groups['ntp_server']|string is search(inventory_hostname)" - - not main_ipv6_exists.stat.exists - - cp_main_ipv6 is changed - notify: - - Restart IPv6 Firewall - -- name: Configure main_ipv6.conf (ntp_allowed_net) - lineinfile: - path: /etc/ipt-firewall/main_ipv6.conf - regexp: '^\s*local_ntp_service' - line: 'ntp_allowed_net="{{ ntp_allowed_ipv6_net }"' - state: present - when: - - "groups['ntp_server']|string is search(inventory_hostname)" - - not main_ipv6_exists.stat.exists - - cp_main_ipv6 is changed - notify: - - Restart IPv6 Firewall - -#- SSH Service - -- name: Configure main_ipv6.conf (ssh_server_ips) - lineinfile: - path: /etc/ipt-firewall/main_ipv6.conf - regexp: '^\s*ssh_server_ips' - line: ssh_server_ips="$ext_ips" - state: present - when: - - not main_ipv6_exists.stat.exists - - cp_main_ipv6 is changed - -# - HTTP Service - -- name: Configure main_ipv6.conf (http_server_ips) - lineinfile: - path: /etc/ipt-firewall/main_ipv6.conf - regexp: '^\s*http_server_ips=' - line: http_server_ips="$ext_1_ip" - state: present - when: - - "groups['apache2_webserver']|string is search(inventory_hostname) or - groups['nginx_webserver']|string is search(inventory_hostname)" - - not main_ipv6_exists.stat.exists - - cp_main_ipv6 is changed - -# - Mail Client Protocolls - -- name: Configure main_ipv6.conf (mail_client_ips) - lineinfile: - path: /etc/ipt-firewall/main_ipv6.conf - regexp: '^\s*mail_client_ips=' - line: mail_client_ips="$ext_1_ip" - state: present - when: - - "groups['apache2_webserver']|string is search(inventory_hostname) or - groups['nginx_webserver']|string is search(inventory_hostname)" - - not main_ipv6_exists.stat.exists - - cp_main_ipv6 is changed - -# - Mail Server - -- name: Configure main_ipv6.conf (smtpd_ips) - lineinfile: - path: /etc/ipt-firewall/main_ipv6.conf - regexp: '^\s*smtpd_ips=' - line: smtpd_ips="$ext_1_ip" - state: present - when: - - "groups['mail_server']|string is search(inventory_hostname)" - - not main_ipv6_exists.stat.exists - - cp_main_ipv6 is changed - -- name: Configure main_ipv6.conf (mail_server_ips) - lineinfile: - path: /etc/ipt-firewall/main_ipv6.conf - regexp: '^\s*mail_server_ips=' - line: mail_server_ips="$ext_1_ip" - state: present - when: - - "groups['mail_server']|string is search(inventory_hostname)" - - not main_ipv6_exists.stat.exists - - cp_main_ipv6 is changed - -# - Dovecot auth service - -- name: Configure main_ipv6.conf (dovecot_auth_service) - lineinfile: - path: /etc/ipt-firewall/main_ipv6.conf - regexp: '^\s*dovecot_auth_service=' - line: dovecot_auth_service=true - state: present - when: - - "groups['mail_server']|string is search(inventory_hostname)" - - has_dovecot_auth_service_ipv6 == true - - not main_ipv6_exists.stat.exists - - cp_main_ipv6 is changed - notify: - - Restart IPv6 Firewall - -- name: Configure main_ipv6.conf (dovecot_auth_port) - lineinfile: - path: /etc/ipt-firewall/main_ipv6.conf - regexp: '^\s*dovecot_auth_port=' - line: dovecot_auth_port={{ dovecot_auth_service_port | default(omit) }} - state: present - when: - - "groups['mail_server']|string is search(inventory_hostname)" - - has_dovecot_auth_service_ipv6 == true - - not main_ipv6_exists.stat.exists - - cp_main_ipv6 is changed - notify: - - Restart IPv6 Firewall - -- name: Configure main_ipv6.conf (dovecot_auth_allowed_networks) - lineinfile: - path: /etc/ipt-firewall/main_ipv6.conf - regexp: '^\s*dovecot_auth_allowed_networks=' - line: dovecot_auth_allowed_networks="{{ (dovecot_auth_allowed_network_ipv6 | join(' ')) | default(omit) }}" - state: present - when: - - "groups['mail_server']|string is search(inventory_hostname)" - - has_dovecot_auth_service_ipv6 == true - - not main_ipv6_exists.stat.exists - - cp_main_ipv6 is changed - notify: - - Restart IPv6 Firewall - -# - FTP Service - -- name: Configure main_ipv6.conf (ftp_server_ips) - lineinfile: - path: /etc/ipt-firewall/main_ipv6.conf - regexp: '^\s*ftp_server_ips=' - line: ftp_server_ips="$ext_1_ip" - state: present - when: - - "groups['ftp_server']|string is search(inventory_hostname)" - - not main_ipv6_exists.stat.exists - - cp_main_ipv6 is changed - -# - XMPP Service - -- name: Configure main_ipv6.conf (xmpp_server_ips) - lineinfile: - path: /etc/ipt-firewall/main_ipv6.conf - regexp: '^\s*xmpp_server_ips=' - line: xmpp_server_ips="$ext_1_ip" - state: present - when: - - "groups['xmpp_server']|string is search(inventory_hostname)" - - not main_ipv6_exists.stat.exists - - cp_main_ipv6 is changed - - xmpp_has_dovecot_auth == true - notify: - - Restart IPv6 Firewall - -- name: Configure main_ipv6.conf (xmmp_remote_out_services) - lineinfile: - path: /etc/ipt-firewall/main_ipv6.conf - regexp: '^\s*xmmp_remote_out_services=' - line: 'xmmp_remote_out_services="{{ xmpp_dovecot_auth_service_ipv6 | default(omit) }}"' - state: present - when: - - "groups['xmpp_server']|string is search(inventory_hostname)" - - not main_ipv6_exists.stat.exists - - cp_main_ipv6 is changed - - xmpp_has_dovecot_auth == true - notify: - - Restart IPv6 Firewall - -# - Munmble Service - -- name: Configure main_ipv6.conf (mumble_server_ips) - lineinfile: - path: /etc/ipt-firewall/main_ipv6.conf - regexp: '^\s*mumble_server_ips=' - line: mumble_server_ips="$ext_1_ip" - state: present - when: - - "groups['mumble_server']|string is search(inventory_hostname)" - - not main_ipv6_exists.stat.exists - - cp_main_ipv6 is changed - -# - Munin Remote IP - -- name: Configure main_ipv6.conf (munin_remote_ip) - lineinfile: - path: /etc/ipt-firewall/main_ipv6.conf - regexp: '^\s*munin_remote_ip=' - line: 'munin_remote_ip="{{ munin_remote_ipv6 }}"' - state: present - notify: - - Restart IPv6 Firewall - -# --- -# Host independet configuration files -# --- - -- name: Check if common configuration files are latest - shell: 'diff {{ git_firewall_repository.dest }}/conf/{{ item }} /etc/ipt-firewall/{{ item }} > /dev/null 2>&1' - changed_when: "diff_output.rc > 0" - # diff_output.rc - # 0 -> unchanged - # 1 -> changed - # 2 -> not present - failed_when: "diff_output.rc > 2" - when: (git_firewall_repository is defined) and (git_firewall_repository|length > 0) - loop: - - default_settings.conf - - include_functions.conf - - load_modules_ipv4.conf - - load_modules_ipv6.conf - - logging_ipv4.conf - - logging_ipv6.conf - - post_declarations.conf - register: diff_output - -- name: Ensure common configuration files are latest - command: cp {{ git_firewall_repository.dest }}/conf/{{ item }} /etc/ipt-firewall/{{ item }} - loop: - - default_settings.conf - - include_functions.conf - - load_modules_ipv4.conf - - load_modules_ipv6.conf - - logging_ipv4.conf - - logging_ipv6.conf - - post_declarations.conf - when: - - (git_firewall_repository is defined) and (git_firewall_repository|length > 0) - - diff_output.changed - notify: - - Restart IPv4 Firewall - - Restart IPv6 Firewall - -# --- -# Firewall scripts -# --- - -- name: Check if firewall scripts are latest - shell: 'diff {{ git_firewall_repository.dest }}/{{ item }} /usr/local/sbin/{{ item }} > /dev/null 2>&1' - changed_when: "diff_script_output.rc > 0" - # diff_output.rc - # 0 -> unchanged - # 1 -> changed - # 2 -> not present - failed_when: "diff_script_output.rc > 2" - when: (git_firewall_repository is defined) and (git_firewall_repository|length > 0) - loop: - - ipt-firewall-server - - ip6t-firewall-server - register: diff_script_output - -- name: Ensure firewall scripts are latest - command: cp {{ git_firewall_repository.dest }}/{{ item }} /usr/local/sbin/{{ item }} - loop: - - ipt-firewall-server - - ip6t-firewall-server - when: - - (git_firewall_repository is defined) and (git_firewall_repository|length > 0) - - diff_script_output.changed - notify: - - Restart IPv4 Firewall - - Restart IPv6 Firewall - -# --- -# Install systemd service files ip[6]t-firewall.service -# --- - -- name: Configure firewall systemd service files - ansible.builtin.template: - src: etc/systemd/system/{{ item }}-firewall.service.j2 - dest: /etc/systemd/system/{{ item }}-firewall.service - register: systemd_service_files_installed - with_items: - - ipt - - ip6t - -- name: Enable firewall services IPv4 - systemd: - name: ipt-firewall - state: stopped - enabled: yes - daemon_reload: yes - when: systemd_service_files_installed is changed - register: firewall_service_started - -- name: Enable firewall services IPv6 - systemd: - name: ip6t-firewall - state: stopped - enabled: yes - daemon_reload: yes - when: systemd_service_files_installed is changed - register: firewall_service_started - -- meta: end_host - when: firewall_service_started is changed - -# --- -# Delete unused files -# --- - -- name: Delete file /etc/ipt-firewall/ports.conf - file: - path: /etc/ipt-firewall/ports.conf - state: absent - when: systemd_service_files_installed is changed diff --git a/roles/firewall/tasks/main.yml b/roles/firewall/tasks/main.yml index 5be151b..623a5af 100644 --- a/roles/firewall/tasks/main.yml +++ b/roles/firewall/tasks/main.yml @@ -3,14 +3,8 @@ # tags supportetd inside caching-nameserver.yml # # apt-caching-nameserver -- import_tasks: ipt-server.yml - when: - - inventory_hostname not in groups['gateway_server'] - - inventory_hostname not in groups['no_ipt_firewall'] - tags: - - git-firewall-repository - - ipt-server - +# Servers (ipt-server) are managed by the role 'ipt-server' (playbook +# ipt-server.yml); this role only handles gateways. - import_tasks: ipt-gateway.yml when: diff --git a/roles/modify-ipt-server/defaults/main.yml b/roles/modify-ipt-server/defaults/main.yml deleted file mode 100644 index 54b3b0a..0000000 --- a/roles/modify-ipt-server/defaults/main.yml +++ /dev/null @@ -1,10 +0,0 @@ ---- - -munin_remote_ipv4: 95.217.64.122 -munin_remote_ipv6: 2a01:4f9:4a:2b57::122 - -git_firewall_repository: - name: ipt-server - repo: https://git.oopen.de/firewall/ipt-server - dest: /usr/local/src/ipt-server - diff --git a/roles/modify-ipt-server/handlers/main.yml b/roles/modify-ipt-server/handlers/main.yml deleted file mode 100644 index 2fe81c6..0000000 --- a/roles/modify-ipt-server/handlers/main.yml +++ /dev/null @@ -1,20 +0,0 @@ -- name: Restart IPv4 Firewall - service: - name: ipt-firewall - state: restarted - when: - - main_ipv4_exists.stat.exists - -- name: Restart IPv6 Firewall - service: - name: ip6t-firewall - state: restarted - when: - - main_ipv6_exists.stat.exists - -- name: Restart Munin Node - service: - name: munin-node - state: restarted - when: - - munin_node_exists.stat.exists diff --git a/roles/modify-ipt-server/tasks/ipt-server.yml b/roles/modify-ipt-server/tasks/ipt-server.yml deleted file mode 100644 index 6174fa3..0000000 --- a/roles/modify-ipt-server/tasks/ipt-server.yml +++ /dev/null @@ -1,511 +0,0 @@ ---- - -# === -# Install/Uodate git firewall repository -# === - -#- meta: end_play -# when: -# - inventory_hostname in groups['gateway_server'] or inventory_hostname in groups['no_ipt_firewall'] or git_firewall_repository is not defined or git_firewall_repository|length < 1 - - -- name: Install/update firewall repository - git: - repo: '{{ git_firewall_repository.repo }}' - dest: '{{ git_firewall_repository.dest }}' - when: git_firewall_repository is defined and git_firewall_repository|length > 0 - - - -# === -# Some Checks -# === - -- name: Check if file '/etc/ipt-firewall/main_ipv6.conf' exists - stat: - path: /etc/ipt-firewall/main_ipv6.conf - register: main_ipv6_exists - -- name: Check if file '/etc/ipt-firewall/main_ipv4.conf' exists - stat: - path: /etc/ipt-firewall/main_ipv4.conf - register: main_ipv4_exists - -- name: Check if file '/etc/ipt-firewall/interfaces_ipv6.conf' exists - stat: - path: /etc/ipt-firewall/interfaces_ipv6.conf - register: interfaces_ipv6_exists - -- name: Check if file '/etc/ipt-firewall/interfaces_ipv4.conf' exists - stat: - path: /etc/ipt-firewall/interfaces_ipv4.conf - register: interfaces_ipv4_exists - -- name: Check if file '/etc/munin/munin-node.conf' exists - stat: - path: /etc/munin/munin-node.conf - register: munin_node_exists - - - -# === -# Adjust/Correct some values.. -# === - -- name: addjust line 'dynaddr_flag' (IPv4) - lineinfile: - path: /etc/ipt-firewall/main_ipv4.conf - regexp: '^dynaddr_flag=' - line: 'dynaddr_flag="1"' - when: - - main_ipv4_exists.stat.exists - notify: - - Restart IPv4 Firewall - - -- name: addjust line 'munin_remote_ip' (IPv4) - lineinfile: - path: /etc/ipt-firewall/main_ipv4.conf - regexp: '^munin_remote_ip=' - line: 'munin_remote_ip="{{ munin_remote_ipv4 }}"' - when: - - main_ipv4_exists.stat.exists - notify: - - Restart IPv4 Firewall - -- name: addjust line 'munin_remote_ip' (IPv6) - lineinfile: - path: /etc/ipt-firewall/main_ipv6.conf - regexp: '^munin_remote_ip=' - line: 'munin_remote_ip="{{ munin_remote_ipv6 }}"' - when: - - main_ipv6_exists.stat.exists - notify: - - Restart IPv6 Firewall - -- name: addjust line 'vpn_ifs' (IPv4) - lineinfile: - path: /etc/ipt-firewall/interfaces_ipv4.conf - regexp: '^vpn_ifs=' - line: 'vpn_ifs="tun+"' - when: - - interfaces_ipv4_exists.stat.exists - notify: - - Restart IPv4 Firewall - -- name: addjust line 'vpn_ifs' (IPv6) - lineinfile: - path: /etc/ipt-firewall/interfaces_ipv6.conf - regexp: '^vpn_ifs=' - line: 'vpn_ifs="tun+"' - when: - - interfaces_ipv6_exists.stat.exists - notify: - - Restart IPv6 Firewall - - - -# === -# Add some Code Block. -# === - -# --- -# Add support for MNDP and mDNS Traffic -# --- - -- name: Check if String 'drop_mndp=..' is present - shell: grep -q -E "^drop_mndp=" /etc/ipt-firewall/main_ipv4.conf - register: drop_mndp_ipv4_present - when: main_ipv4_exists.stat.exists - failed_when: "drop_mndp_ipv4_present.rc > 1" - changed_when: "drop_mndp_ipv4_present.rc > 0" - -- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (drop_mndp) - blockinfile: - path: /etc/ipt-firewall/main_ipv4.conf - insertafter: '^#?\s*drop_icmp' - block: | - - # ------------- - # --- Drop Mikrotik RouterOS Neighbor Discovery Protocol (MNDP) Traffic - # --- Drop Tinc VPN Traffic - # ------------- - - # Tinc VPN Traffic / Mikrotik RouterOS Neighbor Discovery Protocol (MNDP) Traffic - # - # Der UDP-Port 5678 wird üblicherweise von Tinc VPN verwendet. Tinc ist ein - # Open-Source-VPN-Softwarepaket, das für die Erstellung von Virtual Private - # Networks (VPNs) eingesetzt wird, bei denen Netzwerke über das Internet oder - # andere unsichere Netzwerke miteinander verbunden werden. Es nutzt diesen - # Port, um Verbindungen zwischen den Knoten (Nodes) des VPNs zu ermöglichen. - # - # Der UDP-Port 5678 wird auch von MikroTik RouterOS Neighbor Discovery Protocol - # (NDP) verwendet. Dieses Protokoll wird von MikroTik-Routern eingesetzt, um - # benachbarte Geräte im Netzwerk zu entdecken und automatisch zu erkennen. Es - # hilft dabei, die Kommunikation zwischen MikroTik-Geräten zu erleichtern, ohne - # dass eine manuelle IP-Konfiguration erforderlich ist. - # - # MikroTik Neighbor Discovery über UDP-Port 5678 ist speziell darauf ausgelegt, - # Router und Geräte im selben lokalen Netzwerk (LAN) zu identifizieren und - # Informationen über benachbarte MikroTik-Geräte auszutauschen. Dies ist besonders - # nützlich für die Verwaltung und Konfiguration von MikroTik-Geräten im Netzwerk. - # - # Zusammengefasst: - # Der UDP-Port 5678 wird sowohl für MikroTik RouterOS Neighbor Discovery als auch - # für Tinc VPN verwendet, je nachdem, welche Technologie zum Einsatz kommt. - # - drop_mndp=true - - - # ------------- - # --- Drop Multicast DNS Traffic - # ------------- - - # Multicast Domain Name System (mDNS) protocol - # - # UDP Port 5353/ - # - # Der UDP-Port 5353 wird hauptsächlich für Multicast DNS (mDNS) verwendet. - # mDNS ist ein Protokoll, das es Geräten ermöglicht, sich im lokalen Netzwerk - # selbst zu identifizieren und ohne zentrale DNS-Server Namen zu registrieren - # und aufzulösen. Dies wird häufig in lokalen Netzwerken eingesetzt, z.B. bei - # Geräten, die mit Apple's Bonjour oder Avahi (einer Open-Source-Implementierung - # von mDNS) kommunizieren. - # - # UDP port 5353 is mainly used for multicast DNS (mDNS). mDNS is a protocol that - # allows devices to identify themselves on the local network and register and - # resolve names without central DNS servers. This is often used in local - # networks, e.g. for devices that communicate using Apple's Bonjour or Avahi - # (an open-source implementation of mDNS). - # - drop_mdns=true - marker: "# Marker set by modify-ipt-server.yml (drop_mndp)" - when: - - main_ipv4_exists.stat.exists - - drop_mndp_ipv4_present is changed -# notify: -# - Restart IPv4 Firewall - - -- name: Check if String 'drop_mndp=..' is present - shell: grep -q -E "^drop_mndp=" /etc/ipt-firewall/main_ipv6.conf - register: drop_mndp_ipv6_present - when: main_ipv6_exists.stat.exists - failed_when: "drop_mndp_ipv6_present.rc > 1" - changed_when: "drop_mndp_ipv6_present.rc > 0" - -- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (drop_mndp) - blockinfile: - path: /etc/ipt-firewall/main_ipv6.conf - insertafter: '^#?\s*drop_icmp' - block: | - - # ------------- - # --- Drop Mikrotik RouterOS Neighbor Discovery Protocol (MNDP) Traffic - # --- Drop Tinc VPN Traffic - # ------------- - - # Tinc VPN Traffic / Mikrotik RouterOS Neighbor Discovery Protocol (MNDP) Traffic - # - # Der UDP-Port 5678 wird üblicherweise von Tinc VPN verwendet. Tinc ist ein - # Open-Source-VPN-Softwarepaket, das für die Erstellung von Virtual Private - # Networks (VPNs) eingesetzt wird, bei denen Netzwerke über das Internet oder - # andere unsichere Netzwerke miteinander verbunden werden. Es nutzt diesen - # Port, um Verbindungen zwischen den Knoten (Nodes) des VPNs zu ermöglichen. - # - # Der UDP-Port 5678 wird auch von MikroTik RouterOS Neighbor Discovery Protocol - # (NDP) verwendet. Dieses Protokoll wird von MikroTik-Routern eingesetzt, um - # benachbarte Geräte im Netzwerk zu entdecken und automatisch zu erkennen. Es - # hilft dabei, die Kommunikation zwischen MikroTik-Geräten zu erleichtern, ohne - # dass eine manuelle IP-Konfiguration erforderlich ist. - # - # MikroTik Neighbor Discovery über UDP-Port 5678 ist speziell darauf ausgelegt, - # Router und Geräte im selben lokalen Netzwerk (LAN) zu identifizieren und - # Informationen über benachbarte MikroTik-Geräte auszutauschen. Dies ist besonders - # nützlich für die Verwaltung und Konfiguration von MikroTik-Geräten im Netzwerk. - # - # Zusammengefasst: - # Der UDP-Port 5678 wird sowohl für MikroTik RouterOS Neighbor Discovery als auch - # für Tinc VPN verwendet, je nachdem, welche Technologie zum Einsatz kommt. - # - drop_mndp=true - - - # ------------- - # --- Drop Multicast DNS Traffic - # ------------- - - # Multicast Domain Name System (mDNS) protocol - # - # UDP Port 5353/ - # - # Der UDP-Port 5353 wird hauptsächlich für Multicast DNS (mDNS) verwendet. - # mDNS ist ein Protokoll, das es Geräten ermöglicht, sich im lokalen Netzwerk - # selbst zu identifizieren und ohne zentrale DNS-Server Namen zu registrieren - # und aufzulösen. Dies wird häufig in lokalen Netzwerken eingesetzt, z.B. bei - # Geräten, die mit Apple's Bonjour oder Avahi (einer Open-Source-Implementierung - # von mDNS) kommunizieren. - # - # UDP port 5353 is mainly used for multicast DNS (mDNS). mDNS is a protocol that - # allows devices to identify themselves on the local network and register and - # resolve names without central DNS servers. This is often used in local - # networks, e.g. for devices that communicate using Apple's Bonjour or Avahi - # (an open-source implementation of mDNS). - # - drop_mdns=true - marker: "# Marker set by modify-ipt-server.yml (drop_mndp)" - when: - - main_ipv6_exists.stat.exists - - drop_mndp_ipv6_present is changed -# notify: -# - Restart IPv6 Firewall - -# --- -# Fix section Limit Connections - add limit_new_tcp_connections_per_seconds_ports -# --- - -- name: Check if String 'limit_new_tcp_connections_per_seconds_ports=..' is present - shell: grep -q -E "^limit_new_tcp_connections_per_seconds_ports=" /etc/ipt-firewall/main_ipv4.conf - register: drop_limit_new_tcp_connections_per_seconds_ports_present - when: main_ipv4_exists.stat.exists - failed_when: "drop_limit_new_tcp_connections_per_seconds_ports_present.rc > 1" - changed_when: "drop_limit_new_tcp_connections_per_seconds_ports_present.rc > 0" - -- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (limit_new_tcp_connections_per_seconds_ports) - blockinfile: - path: /etc/ipt-firewall/main_ipv4.conf - insertafter: '^#?\s*limit_new_tcp_connections_per_seconds_per_source_IP' - block: | - # - limit_new_tcp_connections_per_seconds_ports - # - - # - comma separated list of ports - # - - # - Example: - # - limit_new_tcp_connections_per_seconds_ports="80,443" - # - limit_new_tcp_connections_per_seconds_ports="80,110,143,443,465,995" - # - limit_new_tcp_connections_per_seconds_ports="" - marker: "# Marker set by modify-ipt-server.yml (limit_new_tcp_connections_per_seconds_ports)" - when: - - main_ipv4_exists.stat.exists - - drop_limit_new_tcp_connections_per_seconds_ports_present is changed -# notify: -# - Restart IPv4 Firewall - - -- name: Check if String 'limit_new_tcp_connections_per_seconds_ports=..' is present - shell: grep -q -E "^limit_new_tcp_connections_per_seconds_ports=" /etc/ipt-firewall/main_ipv6.conf - register: drop_limit_new_tcp_connections_per_seconds_ports_present - when: main_ipv6_exists.stat.exists - failed_when: "drop_limit_new_tcp_connections_per_seconds_ports_present.rc > 1" - changed_when: "drop_limit_new_tcp_connections_per_seconds_ports_present.rc > 0" - -- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (limit_new_tcp_connections_per_seconds_ports) - blockinfile: - path: /etc/ipt-firewall/main_ipv6.conf - insertafter: '^#?\s*limit_new_tcp_connections_per_seconds_per_source_IP' - block: | - # - limit_new_tcp_connections_per_seconds_ports - # - - # - comma separated list of ports - # - - # - Example: - # - limit_new_tcp_connections_per_seconds_ports="80,443" - # - limit_new_tcp_connections_per_seconds_ports="80,110,143,443,465,995" - # - limit_new_tcp_connections_per_seconds_ports="" - marker: "# Marker set by modify-ipt-server.yml (limit_new_tcp_connections_per_seconds_ports)" - when: - - main_ipv6_exists.stat.exists - - drop_limit_new_tcp_connections_per_seconds_ports_present is changed -# notify: -# - Restart IPv6 Firewall - - -# === -# Remove Marker set by blockinfile -# === - -- name: Remove marker IPv4 - replace : - path: /etc/ipt-firewall/main_ipv4.conf - regexp: "^# Marker set by modify-ipt-server.yml.*$" - replace: "" - register: marker_ipv4_removed - #failed_when: "marker_ipv4_removed.rc > 1" - #changed_when: "marker_ipv4_removed.rc < 1" - when: - - main_ipv4_exists.stat.exists - -- name: Remove marker IPv6 - replace : - path: /etc/ipt-firewall/main_ipv6.conf - regexp: "^# Marker set by modify-ipt-server.yml.*$" - replace: "" - register: marker_ipv6_removed - #failed_when: "marker_ipv6_removed.rc > 1" - #changed_when: "marker_ipv6_removed.rc < 1" - when: - - main_ipv6_exists.stat.exists - -- name: Remove marker IPv4 from interfaces_ipv4.conf - replace : - path: /etc/ipt-firewall/interfaces_ipv4.conf - regexp: "^# Marker set by modify-ipt-server.yml.*$" - replace: "" - when: - - interfaces_ipv4_exists.stat.exists - -- name: Remove marker IPv6 from interfaces_ipv6.conf - replace : - path: /etc/ipt-firewall/interfaces_ipv6.conf - regexp: "^# Marker set by modify-ipt-server.yml.*$" - replace: "" - when: - - interfaces_ipv6_exists.stat.exists - - - -# === -# Add Code Line. -# === - - -# --- -# Per IP Connection Limit (add a line) -# --- - -- name: Check if String 'per_IP_connection_limit=..' is present - shell: grep -q -E "^per_IP_connection_limit=" /etc/ipt-firewall/main_ipv4.conf - register: per_ip_connection_limit_settings_ipv4_present - when: main_ipv4_exists.stat.exists - failed_when: "per_ip_connection_limit_settings_ipv4_present.rc > 1" - changed_when: "per_ip_connection_limit_settings_ipv4_present.rc > 0" - -- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (protect_settings) - lineinfile: - path: /etc/ipt-firewall/main_ipv4.conf - insertafter: '^#?\s*limit_connections_per_source_IP' - line: per_IP_connection_limit=$default_per_IP_connection_limit - when: - - main_ipv4_exists.stat.exists - - per_ip_connection_limit_settings_ipv4_present is changed -# notify: -# - Restart IPv4 Firewall - - -- name: Check if String 'per_IP_connection_limit=..' is present - shell: grep -q -E "^per_IP_connection_limit=" /etc/ipt-firewall/main_ipv6.conf - register: per_ip_connection_limit_settings_ipv6_present - when: main_ipv6_exists.stat.exists - failed_when: "per_ip_connection_limit_settings_ipv6_present.rc > 1" - changed_when: "per_ip_connection_limit_settings_ipv6_present.rc > 0" - -- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (protect_settings) - lineinfile: - dest: /etc/ipt-firewall/main_ipv6.conf - insertafter: '^#?\s*limit_connections_per_source_IP' - line: per_IP_connection_limit=$default_per_IP_connection_limit - when: - - main_ipv6_exists.stat.exists - - per_ip_connection_limit_settings_ipv6_present is changed -# notify: -# - Restart IPv6 Firewall - - - -# === -# Confiuration Files -# === - -- name: Check if configuration files are latest - shell: 'diff {{ git_firewall_repository.dest }}/conf/{{ item }} /etc/ipt-firewall/{{ item }} > /dev/null 2>&1' - changed_when: "diff_script_output.rc > 0" - # diff_output.rc - # 0 -> unchanged - # 1 -> changed - # 2 -> not present - failed_when: "diff_script_output.rc > 2" - when: - - git_firewall_repository is defined and git_firewall_repository|length > 0 - loop: - - default_settings.conf - - include_functions.conf - - load_modules_ipv4.conf - - load_modules_ipv6.conf - - logging_ipv4.conf - - logging_ipv6.conf - - post_declarations.conf - register: diff_script_output - -- name: Ensure configuration files are latest - command: cp {{ git_firewall_repository.dest }}/conf/{{ item }} /etc/ipt-firewall/{{ item }} - loop: - - default_settings.conf - - include_functions.conf - - load_modules_ipv4.conf - - load_modules_ipv6.conf - - logging_ipv4.conf - - logging_ipv6.conf - - post_declarations.conf - when: - - git_firewall_repository is defined and git_firewall_repository|length > 0 - - diff_script_output.changed -# notify: -# - Restart IPv4 Firewall -# - Restart IPv6 Firewall - - - -# === -# Firewall scripts -# === - -- name: Check if firewall scripts are latest - shell: 'diff {{ git_firewall_repository.dest }}/{{ item }} /usr/local/sbin/{{ item }} > /dev/null 2>&1' - changed_when: "diff_script_output.rc > 0" - # diff_output.rc - # 0 -> unchanged - # 1 -> changed - # 2 -> not present - failed_when: "diff_script_output.rc > 2" - when: - - git_firewall_repository is defined and git_firewall_repository|length > 0 - loop: - - ipt-firewall-server - - ip6t-firewall-server - register: diff_script_output - -- name: Ensure firewall scripts are latest - command: cp {{ git_firewall_repository.dest }}/{{ item }} /usr/local/sbin/{{ item }} - loop: - - ipt-firewall-server - - ip6t-firewall-server - when: - - git_firewall_repository is defined and git_firewall_repository|length > 0 - - diff_script_output.changed -# notify: -# - Restart IPv4 Firewall -# - Restart IPv6 Firewall - - - -# === -# Delete files that are no longer required -# === - -- name: Delete file '/etc/ipt-firewall/default_ports.conf' .. - file: - state: absent - path: /etc/ipt-firewall/default_ports.conf - -- name: Delete file '/etc/ipt-firewall/ports.conf' .. - file: - state: absent - path: /etc/ipt-firewall/ports.conf - -- name: Delete file '/etc/ipt-firewall/ports.conf' .. - file: - state: absent - path: /etc/ipt-firewall/post_decalrations.conf - diff --git a/roles/modify-ipt-server/tasks/main.yml b/roles/modify-ipt-server/tasks/main.yml deleted file mode 100644 index f892886..0000000 --- a/roles/modify-ipt-server/tasks/main.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- - -- import_tasks: ipt-server.yml - when: - - inventory_hostname not in groups['gateway_server'] - - inventory_hostname not in groups['no_ipt_firewall'] - tags: - - git-firewall-repository - - ipt-server