Retire old server firewall management (roles firewall/ipt-server part, modify-ipt-server).
All ipt servers are now managed by the role ipt-server (playbook ipt-server.yml):
- roles/firewall: only handles gateways now.
- Remove playbook modify-ipt-server.yml and role modify-ipt-server.
- Remove git_firewall_repository (ipt-server) and the ipt-server entries of
git_{oopen,warenform}_server_repositories, so role common no longer
clones /usr/local/src/ipt-server. Gateways keep ipt-gateway.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Claude Opus 5.5
+4
-12
@@ -2668,22 +2668,14 @@ git_default_repositories:
|
||||
# ---
|
||||
# group [oopen_server]
|
||||
# ---
|
||||
git_oopen_server_repositories:
|
||||
|
||||
# firewall
|
||||
- name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
# (ipt-server firewall is installed by the role 'ipt-server')
|
||||
git_oopen_server_repositories: []
|
||||
|
||||
# ---
|
||||
# group [warenform_server]
|
||||
# ---
|
||||
git_warenform_server_repositories:
|
||||
|
||||
# firewall
|
||||
- name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
# (ipt-server firewall is installed by the role 'ipt-server')
|
||||
git_warenform_server_repositories: []
|
||||
|
||||
# ---
|
||||
# group [lxc_host]
|
||||
|
||||
@@ -117,15 +117,6 @@ sudo_users:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -54,12 +54,3 @@ sshd_ports:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
|
||||
@@ -119,15 +119,6 @@ sudo_users:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
@@ -398,15 +398,6 @@ sudoers_file_user_back_svn_privileges:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -286,15 +286,6 @@ sudo_users:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
@@ -177,15 +177,6 @@ sudo_users:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -126,15 +126,6 @@ sudoers_file_user_back_svn_privileges:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -113,15 +113,6 @@ sudoers_file_user_back_svn_privileges:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -202,15 +202,6 @@ sudo_users:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -123,15 +123,6 @@ resolved_fallback_nameserver:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -203,15 +203,6 @@ sudo_users:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -185,15 +185,6 @@ sudo_users:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -127,15 +127,6 @@ resolved_fallback_nameserver:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -189,11 +189,6 @@ cron_user_entries:
|
||||
#
|
||||
# see: roles/common/tasks/vars
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
git_other_repositories:
|
||||
- name: jitsi
|
||||
repo: https://git.oopen.de/install/jitsi
|
||||
|
||||
@@ -185,15 +185,6 @@ cron_user_entries:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
git_other_repositories:
|
||||
- name: jitsi
|
||||
repo: https://git.oopen.de/install/jitsi
|
||||
|
||||
@@ -179,15 +179,6 @@ cron_user_entries:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -202,15 +202,6 @@ sudo_users:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -202,15 +202,6 @@ sudo_users:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -184,15 +184,6 @@ cron_user_entries:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -130,15 +130,6 @@ sudoers_file_user_back_svn_privileges:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -130,15 +130,6 @@ sudoers_file_user_back_svn_privileges:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -151,15 +151,6 @@ ssh_keypair_backup_client:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
@@ -151,15 +151,6 @@ ssh_keypair_backup_client:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
@@ -151,15 +151,6 @@ ssh_keypair_backup_client:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
@@ -306,15 +306,6 @@ cron_user_entries:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -149,15 +149,6 @@ sudo_users:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -153,15 +153,6 @@ sudo_users:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -149,15 +149,6 @@ sudo_users:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -149,15 +149,6 @@ sudo_users:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -155,15 +155,6 @@ sudo_users:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -149,15 +149,6 @@ sudo_users:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -234,15 +234,6 @@ sudo_users:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -311,15 +311,6 @@ cron_user_entries:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/samba-config-server.yml
|
||||
|
||||
@@ -302,15 +302,6 @@ cron_user_entries:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -306,15 +306,6 @@ cron_user_entries:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -203,15 +203,6 @@ cron_user_entries:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -337,15 +337,6 @@ cron_user_entries:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -314,15 +314,6 @@ cron_user_entries:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -315,15 +315,6 @@ cron_user_entries:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -312,15 +312,6 @@ cron_user_entries:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -428,15 +428,6 @@ cron_user_entries:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -531,15 +531,6 @@ sudo_users:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -312,15 +312,6 @@ cron_user_entries:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -297,15 +297,6 @@ cron_user_entries:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -307,15 +307,6 @@ cron_user_entries:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -303,15 +303,6 @@ cron_user_entries:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -315,15 +315,6 @@ cron_user_entries:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -362,15 +362,6 @@ sudoers_file_user_privileges:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -353,15 +353,6 @@ sudoers_file_user_privileges:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -307,15 +307,6 @@ cron_user_entries:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -305,15 +305,6 @@ cron_user_entries:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -306,15 +306,6 @@ cron_user_entries:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -302,15 +302,6 @@ cron_user_entries:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -307,15 +307,6 @@ cron_user_entries:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -184,15 +184,6 @@ cron_user_entries:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -302,15 +302,6 @@ cron_user_entries:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -394,15 +394,6 @@ cron_user_entries:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -306,15 +306,6 @@ cron_user_entries:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -307,15 +307,6 @@ cron_user_entries:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -123,15 +123,6 @@ resolved_fallback_nameserver:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -162,15 +162,6 @@ ssh_keypair_backup_client:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
@@ -187,15 +187,6 @@ sudo_users:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -334,15 +334,6 @@ copy_plain_files:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
@@ -321,15 +321,6 @@ copy_plain_files:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
@@ -326,15 +326,6 @@ copy_plain_files:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
@@ -329,15 +329,6 @@ copy_plain_files:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
@@ -330,15 +330,6 @@ copy_plain_files:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
@@ -345,15 +345,6 @@ copy_plain_files:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
@@ -352,15 +352,6 @@ copy_plain_files:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
@@ -142,15 +142,6 @@ resolved_fallback_nameserver:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
@@ -146,15 +146,6 @@ ssh_keypair_backup_client:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
@@ -145,15 +145,6 @@ ssh_keypair_backup_client:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
@@ -127,15 +127,6 @@ resolved_fallback_nameserver:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -127,15 +127,6 @@ resolved_fallback_nameserver:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -127,15 +127,6 @@ resolved_fallback_nameserver:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -127,15 +127,6 @@ resolved_fallback_nameserver:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -125,15 +125,6 @@ resolved_fallback_nameserver:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -125,15 +125,6 @@ resolved_fallback_nameserver:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -125,15 +125,6 @@ resolved_fallback_nameserver:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -125,15 +125,6 @@ resolved_fallback_nameserver:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -127,15 +127,6 @@ resolved_fallback_nameserver:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -215,15 +215,6 @@ sudo_users:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
|
||||
@@ -129,11 +129,6 @@ resolved_fallback_nameserver:
|
||||
#
|
||||
# see: roles/common/tasks/vars
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/copy_files.yml
|
||||
|
||||
@@ -166,15 +166,6 @@ sudoers_file_user_privileges:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
@@ -148,15 +148,6 @@ ssh_keypair_backup_client:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
@@ -147,15 +147,6 @@ ssh_keypair_backup_client:
|
||||
# ---
|
||||
|
||||
|
||||
# ---
|
||||
# vars used by roles/common/tasks/git.yml
|
||||
# ---
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
|
||||
# ==============================
|
||||
|
||||
|
||||
@@ -1,9 +0,0 @@
|
||||
---
|
||||
|
||||
|
||||
- hosts:
|
||||
- oopen_server
|
||||
- warenform_server
|
||||
- so36_server
|
||||
roles:
|
||||
- modify-ipt-server
|
||||
File diff suppressed because it is too large
Load Diff
@@ -3,14 +3,8 @@
|
||||
# tags supportetd inside caching-nameserver.yml
|
||||
#
|
||||
# apt-caching-nameserver
|
||||
- import_tasks: ipt-server.yml
|
||||
when:
|
||||
- inventory_hostname not in groups['gateway_server']
|
||||
- inventory_hostname not in groups['no_ipt_firewall']
|
||||
tags:
|
||||
- git-firewall-repository
|
||||
- ipt-server
|
||||
|
||||
# Servers (ipt-server) are managed by the role 'ipt-server' (playbook
|
||||
# ipt-server.yml); this role only handles gateways.
|
||||
|
||||
- import_tasks: ipt-gateway.yml
|
||||
when:
|
||||
|
||||
@@ -1,10 +0,0 @@
|
||||
---
|
||||
|
||||
munin_remote_ipv4: 95.217.64.122
|
||||
munin_remote_ipv6: 2a01:4f9:4a:2b57::122
|
||||
|
||||
git_firewall_repository:
|
||||
name: ipt-server
|
||||
repo: https://git.oopen.de/firewall/ipt-server
|
||||
dest: /usr/local/src/ipt-server
|
||||
|
||||
@@ -1,20 +0,0 @@
|
||||
- name: Restart IPv4 Firewall
|
||||
service:
|
||||
name: ipt-firewall
|
||||
state: restarted
|
||||
when:
|
||||
- main_ipv4_exists.stat.exists
|
||||
|
||||
- name: Restart IPv6 Firewall
|
||||
service:
|
||||
name: ip6t-firewall
|
||||
state: restarted
|
||||
when:
|
||||
- main_ipv6_exists.stat.exists
|
||||
|
||||
- name: Restart Munin Node
|
||||
service:
|
||||
name: munin-node
|
||||
state: restarted
|
||||
when:
|
||||
- munin_node_exists.stat.exists
|
||||
@@ -1,511 +0,0 @@
|
||||
---
|
||||
|
||||
# ===
|
||||
# Install/Uodate git firewall repository
|
||||
# ===
|
||||
|
||||
#- meta: end_play
|
||||
# when:
|
||||
# - inventory_hostname in groups['gateway_server'] or inventory_hostname in groups['no_ipt_firewall'] or git_firewall_repository is not defined or git_firewall_repository|length < 1
|
||||
|
||||
|
||||
- name: Install/update firewall repository
|
||||
git:
|
||||
repo: '{{ git_firewall_repository.repo }}'
|
||||
dest: '{{ git_firewall_repository.dest }}'
|
||||
when: git_firewall_repository is defined and git_firewall_repository|length > 0
|
||||
|
||||
|
||||
|
||||
# ===
|
||||
# Some Checks
|
||||
# ===
|
||||
|
||||
- name: Check if file '/etc/ipt-firewall/main_ipv6.conf' exists
|
||||
stat:
|
||||
path: /etc/ipt-firewall/main_ipv6.conf
|
||||
register: main_ipv6_exists
|
||||
|
||||
- name: Check if file '/etc/ipt-firewall/main_ipv4.conf' exists
|
||||
stat:
|
||||
path: /etc/ipt-firewall/main_ipv4.conf
|
||||
register: main_ipv4_exists
|
||||
|
||||
- name: Check if file '/etc/ipt-firewall/interfaces_ipv6.conf' exists
|
||||
stat:
|
||||
path: /etc/ipt-firewall/interfaces_ipv6.conf
|
||||
register: interfaces_ipv6_exists
|
||||
|
||||
- name: Check if file '/etc/ipt-firewall/interfaces_ipv4.conf' exists
|
||||
stat:
|
||||
path: /etc/ipt-firewall/interfaces_ipv4.conf
|
||||
register: interfaces_ipv4_exists
|
||||
|
||||
- name: Check if file '/etc/munin/munin-node.conf' exists
|
||||
stat:
|
||||
path: /etc/munin/munin-node.conf
|
||||
register: munin_node_exists
|
||||
|
||||
|
||||
|
||||
# ===
|
||||
# Adjust/Correct some values..
|
||||
# ===
|
||||
|
||||
- name: addjust line 'dynaddr_flag' (IPv4)
|
||||
lineinfile:
|
||||
path: /etc/ipt-firewall/main_ipv4.conf
|
||||
regexp: '^dynaddr_flag='
|
||||
line: 'dynaddr_flag="1"'
|
||||
when:
|
||||
- main_ipv4_exists.stat.exists
|
||||
notify:
|
||||
- Restart IPv4 Firewall
|
||||
|
||||
|
||||
- name: addjust line 'munin_remote_ip' (IPv4)
|
||||
lineinfile:
|
||||
path: /etc/ipt-firewall/main_ipv4.conf
|
||||
regexp: '^munin_remote_ip='
|
||||
line: 'munin_remote_ip="{{ munin_remote_ipv4 }}"'
|
||||
when:
|
||||
- main_ipv4_exists.stat.exists
|
||||
notify:
|
||||
- Restart IPv4 Firewall
|
||||
|
||||
- name: addjust line 'munin_remote_ip' (IPv6)
|
||||
lineinfile:
|
||||
path: /etc/ipt-firewall/main_ipv6.conf
|
||||
regexp: '^munin_remote_ip='
|
||||
line: 'munin_remote_ip="{{ munin_remote_ipv6 }}"'
|
||||
when:
|
||||
- main_ipv6_exists.stat.exists
|
||||
notify:
|
||||
- Restart IPv6 Firewall
|
||||
|
||||
- name: addjust line 'vpn_ifs' (IPv4)
|
||||
lineinfile:
|
||||
path: /etc/ipt-firewall/interfaces_ipv4.conf
|
||||
regexp: '^vpn_ifs='
|
||||
line: 'vpn_ifs="tun+"'
|
||||
when:
|
||||
- interfaces_ipv4_exists.stat.exists
|
||||
notify:
|
||||
- Restart IPv4 Firewall
|
||||
|
||||
- name: addjust line 'vpn_ifs' (IPv6)
|
||||
lineinfile:
|
||||
path: /etc/ipt-firewall/interfaces_ipv6.conf
|
||||
regexp: '^vpn_ifs='
|
||||
line: 'vpn_ifs="tun+"'
|
||||
when:
|
||||
- interfaces_ipv6_exists.stat.exists
|
||||
notify:
|
||||
- Restart IPv6 Firewall
|
||||
|
||||
|
||||
|
||||
# ===
|
||||
# Add some Code Block.
|
||||
# ===
|
||||
|
||||
# ---
|
||||
# Add support for MNDP and mDNS Traffic
|
||||
# ---
|
||||
|
||||
- name: Check if String 'drop_mndp=..' is present
|
||||
shell: grep -q -E "^drop_mndp=" /etc/ipt-firewall/main_ipv4.conf
|
||||
register: drop_mndp_ipv4_present
|
||||
when: main_ipv4_exists.stat.exists
|
||||
failed_when: "drop_mndp_ipv4_present.rc > 1"
|
||||
changed_when: "drop_mndp_ipv4_present.rc > 0"
|
||||
|
||||
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (drop_mndp)
|
||||
blockinfile:
|
||||
path: /etc/ipt-firewall/main_ipv4.conf
|
||||
insertafter: '^#?\s*drop_icmp'
|
||||
block: |
|
||||
|
||||
# -------------
|
||||
# --- Drop Mikrotik RouterOS Neighbor Discovery Protocol (MNDP) Traffic
|
||||
# --- Drop Tinc VPN Traffic
|
||||
# -------------
|
||||
|
||||
# Tinc VPN Traffic / Mikrotik RouterOS Neighbor Discovery Protocol (MNDP) Traffic
|
||||
#
|
||||
# Der UDP-Port 5678 wird üblicherweise von Tinc VPN verwendet. Tinc ist ein
|
||||
# Open-Source-VPN-Softwarepaket, das für die Erstellung von Virtual Private
|
||||
# Networks (VPNs) eingesetzt wird, bei denen Netzwerke über das Internet oder
|
||||
# andere unsichere Netzwerke miteinander verbunden werden. Es nutzt diesen
|
||||
# Port, um Verbindungen zwischen den Knoten (Nodes) des VPNs zu ermöglichen.
|
||||
#
|
||||
# Der UDP-Port 5678 wird auch von MikroTik RouterOS Neighbor Discovery Protocol
|
||||
# (NDP) verwendet. Dieses Protokoll wird von MikroTik-Routern eingesetzt, um
|
||||
# benachbarte Geräte im Netzwerk zu entdecken und automatisch zu erkennen. Es
|
||||
# hilft dabei, die Kommunikation zwischen MikroTik-Geräten zu erleichtern, ohne
|
||||
# dass eine manuelle IP-Konfiguration erforderlich ist.
|
||||
#
|
||||
# MikroTik Neighbor Discovery über UDP-Port 5678 ist speziell darauf ausgelegt,
|
||||
# Router und Geräte im selben lokalen Netzwerk (LAN) zu identifizieren und
|
||||
# Informationen über benachbarte MikroTik-Geräte auszutauschen. Dies ist besonders
|
||||
# nützlich für die Verwaltung und Konfiguration von MikroTik-Geräten im Netzwerk.
|
||||
#
|
||||
# Zusammengefasst:
|
||||
# Der UDP-Port 5678 wird sowohl für MikroTik RouterOS Neighbor Discovery als auch
|
||||
# für Tinc VPN verwendet, je nachdem, welche Technologie zum Einsatz kommt.
|
||||
#
|
||||
drop_mndp=true
|
||||
|
||||
|
||||
# -------------
|
||||
# --- Drop Multicast DNS Traffic
|
||||
# -------------
|
||||
|
||||
# Multicast Domain Name System (mDNS) protocol
|
||||
#
|
||||
# UDP Port 5353/
|
||||
#
|
||||
# Der UDP-Port 5353 wird hauptsächlich für Multicast DNS (mDNS) verwendet.
|
||||
# mDNS ist ein Protokoll, das es Geräten ermöglicht, sich im lokalen Netzwerk
|
||||
# selbst zu identifizieren und ohne zentrale DNS-Server Namen zu registrieren
|
||||
# und aufzulösen. Dies wird häufig in lokalen Netzwerken eingesetzt, z.B. bei
|
||||
# Geräten, die mit Apple's Bonjour oder Avahi (einer Open-Source-Implementierung
|
||||
# von mDNS) kommunizieren.
|
||||
#
|
||||
# UDP port 5353 is mainly used for multicast DNS (mDNS). mDNS is a protocol that
|
||||
# allows devices to identify themselves on the local network and register and
|
||||
# resolve names without central DNS servers. This is often used in local
|
||||
# networks, e.g. for devices that communicate using Apple's Bonjour or Avahi
|
||||
# (an open-source implementation of mDNS).
|
||||
#
|
||||
drop_mdns=true
|
||||
marker: "# Marker set by modify-ipt-server.yml (drop_mndp)"
|
||||
when:
|
||||
- main_ipv4_exists.stat.exists
|
||||
- drop_mndp_ipv4_present is changed
|
||||
# notify:
|
||||
# - Restart IPv4 Firewall
|
||||
|
||||
|
||||
- name: Check if String 'drop_mndp=..' is present
|
||||
shell: grep -q -E "^drop_mndp=" /etc/ipt-firewall/main_ipv6.conf
|
||||
register: drop_mndp_ipv6_present
|
||||
when: main_ipv6_exists.stat.exists
|
||||
failed_when: "drop_mndp_ipv6_present.rc > 1"
|
||||
changed_when: "drop_mndp_ipv6_present.rc > 0"
|
||||
|
||||
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (drop_mndp)
|
||||
blockinfile:
|
||||
path: /etc/ipt-firewall/main_ipv6.conf
|
||||
insertafter: '^#?\s*drop_icmp'
|
||||
block: |
|
||||
|
||||
# -------------
|
||||
# --- Drop Mikrotik RouterOS Neighbor Discovery Protocol (MNDP) Traffic
|
||||
# --- Drop Tinc VPN Traffic
|
||||
# -------------
|
||||
|
||||
# Tinc VPN Traffic / Mikrotik RouterOS Neighbor Discovery Protocol (MNDP) Traffic
|
||||
#
|
||||
# Der UDP-Port 5678 wird üblicherweise von Tinc VPN verwendet. Tinc ist ein
|
||||
# Open-Source-VPN-Softwarepaket, das für die Erstellung von Virtual Private
|
||||
# Networks (VPNs) eingesetzt wird, bei denen Netzwerke über das Internet oder
|
||||
# andere unsichere Netzwerke miteinander verbunden werden. Es nutzt diesen
|
||||
# Port, um Verbindungen zwischen den Knoten (Nodes) des VPNs zu ermöglichen.
|
||||
#
|
||||
# Der UDP-Port 5678 wird auch von MikroTik RouterOS Neighbor Discovery Protocol
|
||||
# (NDP) verwendet. Dieses Protokoll wird von MikroTik-Routern eingesetzt, um
|
||||
# benachbarte Geräte im Netzwerk zu entdecken und automatisch zu erkennen. Es
|
||||
# hilft dabei, die Kommunikation zwischen MikroTik-Geräten zu erleichtern, ohne
|
||||
# dass eine manuelle IP-Konfiguration erforderlich ist.
|
||||
#
|
||||
# MikroTik Neighbor Discovery über UDP-Port 5678 ist speziell darauf ausgelegt,
|
||||
# Router und Geräte im selben lokalen Netzwerk (LAN) zu identifizieren und
|
||||
# Informationen über benachbarte MikroTik-Geräte auszutauschen. Dies ist besonders
|
||||
# nützlich für die Verwaltung und Konfiguration von MikroTik-Geräten im Netzwerk.
|
||||
#
|
||||
# Zusammengefasst:
|
||||
# Der UDP-Port 5678 wird sowohl für MikroTik RouterOS Neighbor Discovery als auch
|
||||
# für Tinc VPN verwendet, je nachdem, welche Technologie zum Einsatz kommt.
|
||||
#
|
||||
drop_mndp=true
|
||||
|
||||
|
||||
# -------------
|
||||
# --- Drop Multicast DNS Traffic
|
||||
# -------------
|
||||
|
||||
# Multicast Domain Name System (mDNS) protocol
|
||||
#
|
||||
# UDP Port 5353/
|
||||
#
|
||||
# Der UDP-Port 5353 wird hauptsächlich für Multicast DNS (mDNS) verwendet.
|
||||
# mDNS ist ein Protokoll, das es Geräten ermöglicht, sich im lokalen Netzwerk
|
||||
# selbst zu identifizieren und ohne zentrale DNS-Server Namen zu registrieren
|
||||
# und aufzulösen. Dies wird häufig in lokalen Netzwerken eingesetzt, z.B. bei
|
||||
# Geräten, die mit Apple's Bonjour oder Avahi (einer Open-Source-Implementierung
|
||||
# von mDNS) kommunizieren.
|
||||
#
|
||||
# UDP port 5353 is mainly used for multicast DNS (mDNS). mDNS is a protocol that
|
||||
# allows devices to identify themselves on the local network and register and
|
||||
# resolve names without central DNS servers. This is often used in local
|
||||
# networks, e.g. for devices that communicate using Apple's Bonjour or Avahi
|
||||
# (an open-source implementation of mDNS).
|
||||
#
|
||||
drop_mdns=true
|
||||
marker: "# Marker set by modify-ipt-server.yml (drop_mndp)"
|
||||
when:
|
||||
- main_ipv6_exists.stat.exists
|
||||
- drop_mndp_ipv6_present is changed
|
||||
# notify:
|
||||
# - Restart IPv6 Firewall
|
||||
|
||||
# ---
|
||||
# Fix section Limit Connections - add limit_new_tcp_connections_per_seconds_ports
|
||||
# ---
|
||||
|
||||
- name: Check if String 'limit_new_tcp_connections_per_seconds_ports=..' is present
|
||||
shell: grep -q -E "^limit_new_tcp_connections_per_seconds_ports=" /etc/ipt-firewall/main_ipv4.conf
|
||||
register: drop_limit_new_tcp_connections_per_seconds_ports_present
|
||||
when: main_ipv4_exists.stat.exists
|
||||
failed_when: "drop_limit_new_tcp_connections_per_seconds_ports_present.rc > 1"
|
||||
changed_when: "drop_limit_new_tcp_connections_per_seconds_ports_present.rc > 0"
|
||||
|
||||
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (limit_new_tcp_connections_per_seconds_ports)
|
||||
blockinfile:
|
||||
path: /etc/ipt-firewall/main_ipv4.conf
|
||||
insertafter: '^#?\s*limit_new_tcp_connections_per_seconds_per_source_IP'
|
||||
block: |
|
||||
# - limit_new_tcp_connections_per_seconds_ports
|
||||
# -
|
||||
# - comma separated list of ports
|
||||
# -
|
||||
# - Example:
|
||||
# - limit_new_tcp_connections_per_seconds_ports="80,443"
|
||||
# - limit_new_tcp_connections_per_seconds_ports="80,110,143,443,465,995"
|
||||
#
|
||||
limit_new_tcp_connections_per_seconds_ports=""
|
||||
marker: "# Marker set by modify-ipt-server.yml (limit_new_tcp_connections_per_seconds_ports)"
|
||||
when:
|
||||
- main_ipv4_exists.stat.exists
|
||||
- drop_limit_new_tcp_connections_per_seconds_ports_present is changed
|
||||
# notify:
|
||||
# - Restart IPv4 Firewall
|
||||
|
||||
|
||||
- name: Check if String 'limit_new_tcp_connections_per_seconds_ports=..' is present
|
||||
shell: grep -q -E "^limit_new_tcp_connections_per_seconds_ports=" /etc/ipt-firewall/main_ipv6.conf
|
||||
register: drop_limit_new_tcp_connections_per_seconds_ports_present
|
||||
when: main_ipv6_exists.stat.exists
|
||||
failed_when: "drop_limit_new_tcp_connections_per_seconds_ports_present.rc > 1"
|
||||
changed_when: "drop_limit_new_tcp_connections_per_seconds_ports_present.rc > 0"
|
||||
|
||||
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (limit_new_tcp_connections_per_seconds_ports)
|
||||
blockinfile:
|
||||
path: /etc/ipt-firewall/main_ipv6.conf
|
||||
insertafter: '^#?\s*limit_new_tcp_connections_per_seconds_per_source_IP'
|
||||
block: |
|
||||
# - limit_new_tcp_connections_per_seconds_ports
|
||||
# -
|
||||
# - comma separated list of ports
|
||||
# -
|
||||
# - Example:
|
||||
# - limit_new_tcp_connections_per_seconds_ports="80,443"
|
||||
# - limit_new_tcp_connections_per_seconds_ports="80,110,143,443,465,995"
|
||||
#
|
||||
limit_new_tcp_connections_per_seconds_ports=""
|
||||
marker: "# Marker set by modify-ipt-server.yml (limit_new_tcp_connections_per_seconds_ports)"
|
||||
when:
|
||||
- main_ipv6_exists.stat.exists
|
||||
- drop_limit_new_tcp_connections_per_seconds_ports_present is changed
|
||||
# notify:
|
||||
# - Restart IPv6 Firewall
|
||||
|
||||
|
||||
# ===
|
||||
# Remove Marker set by blockinfile
|
||||
# ===
|
||||
|
||||
- name: Remove marker IPv4
|
||||
replace :
|
||||
path: /etc/ipt-firewall/main_ipv4.conf
|
||||
regexp: "^# Marker set by modify-ipt-server.yml.*$"
|
||||
replace: ""
|
||||
register: marker_ipv4_removed
|
||||
#failed_when: "marker_ipv4_removed.rc > 1"
|
||||
#changed_when: "marker_ipv4_removed.rc < 1"
|
||||
when:
|
||||
- main_ipv4_exists.stat.exists
|
||||
|
||||
- name: Remove marker IPv6
|
||||
replace :
|
||||
path: /etc/ipt-firewall/main_ipv6.conf
|
||||
regexp: "^# Marker set by modify-ipt-server.yml.*$"
|
||||
replace: ""
|
||||
register: marker_ipv6_removed
|
||||
#failed_when: "marker_ipv6_removed.rc > 1"
|
||||
#changed_when: "marker_ipv6_removed.rc < 1"
|
||||
when:
|
||||
- main_ipv6_exists.stat.exists
|
||||
|
||||
- name: Remove marker IPv4 from interfaces_ipv4.conf
|
||||
replace :
|
||||
path: /etc/ipt-firewall/interfaces_ipv4.conf
|
||||
regexp: "^# Marker set by modify-ipt-server.yml.*$"
|
||||
replace: ""
|
||||
when:
|
||||
- interfaces_ipv4_exists.stat.exists
|
||||
|
||||
- name: Remove marker IPv6 from interfaces_ipv6.conf
|
||||
replace :
|
||||
path: /etc/ipt-firewall/interfaces_ipv6.conf
|
||||
regexp: "^# Marker set by modify-ipt-server.yml.*$"
|
||||
replace: ""
|
||||
when:
|
||||
- interfaces_ipv6_exists.stat.exists
|
||||
|
||||
|
||||
|
||||
# ===
|
||||
# Add Code Line.
|
||||
# ===
|
||||
|
||||
|
||||
# ---
|
||||
# Per IP Connection Limit (add a line)
|
||||
# ---
|
||||
|
||||
- name: Check if String 'per_IP_connection_limit=..' is present
|
||||
shell: grep -q -E "^per_IP_connection_limit=" /etc/ipt-firewall/main_ipv4.conf
|
||||
register: per_ip_connection_limit_settings_ipv4_present
|
||||
when: main_ipv4_exists.stat.exists
|
||||
failed_when: "per_ip_connection_limit_settings_ipv4_present.rc > 1"
|
||||
changed_when: "per_ip_connection_limit_settings_ipv4_present.rc > 0"
|
||||
|
||||
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (protect_settings)
|
||||
lineinfile:
|
||||
path: /etc/ipt-firewall/main_ipv4.conf
|
||||
insertafter: '^#?\s*limit_connections_per_source_IP'
|
||||
line: per_IP_connection_limit=$default_per_IP_connection_limit
|
||||
when:
|
||||
- main_ipv4_exists.stat.exists
|
||||
- per_ip_connection_limit_settings_ipv4_present is changed
|
||||
# notify:
|
||||
# - Restart IPv4 Firewall
|
||||
|
||||
|
||||
- name: Check if String 'per_IP_connection_limit=..' is present
|
||||
shell: grep -q -E "^per_IP_connection_limit=" /etc/ipt-firewall/main_ipv6.conf
|
||||
register: per_ip_connection_limit_settings_ipv6_present
|
||||
when: main_ipv6_exists.stat.exists
|
||||
failed_when: "per_ip_connection_limit_settings_ipv6_present.rc > 1"
|
||||
changed_when: "per_ip_connection_limit_settings_ipv6_present.rc > 0"
|
||||
|
||||
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (protect_settings)
|
||||
lineinfile:
|
||||
dest: /etc/ipt-firewall/main_ipv6.conf
|
||||
insertafter: '^#?\s*limit_connections_per_source_IP'
|
||||
line: per_IP_connection_limit=$default_per_IP_connection_limit
|
||||
when:
|
||||
- main_ipv6_exists.stat.exists
|
||||
- per_ip_connection_limit_settings_ipv6_present is changed
|
||||
# notify:
|
||||
# - Restart IPv6 Firewall
|
||||
|
||||
|
||||
|
||||
# ===
|
||||
# Confiuration Files
|
||||
# ===
|
||||
|
||||
- name: Check if configuration files are latest
|
||||
shell: 'diff {{ git_firewall_repository.dest }}/conf/{{ item }} /etc/ipt-firewall/{{ item }} > /dev/null 2>&1'
|
||||
changed_when: "diff_script_output.rc > 0"
|
||||
# diff_output.rc
|
||||
# 0 -> unchanged
|
||||
# 1 -> changed
|
||||
# 2 -> not present
|
||||
failed_when: "diff_script_output.rc > 2"
|
||||
when:
|
||||
- git_firewall_repository is defined and git_firewall_repository|length > 0
|
||||
loop:
|
||||
- default_settings.conf
|
||||
- include_functions.conf
|
||||
- load_modules_ipv4.conf
|
||||
- load_modules_ipv6.conf
|
||||
- logging_ipv4.conf
|
||||
- logging_ipv6.conf
|
||||
- post_declarations.conf
|
||||
register: diff_script_output
|
||||
|
||||
- name: Ensure configuration files are latest
|
||||
command: cp {{ git_firewall_repository.dest }}/conf/{{ item }} /etc/ipt-firewall/{{ item }}
|
||||
loop:
|
||||
- default_settings.conf
|
||||
- include_functions.conf
|
||||
- load_modules_ipv4.conf
|
||||
- load_modules_ipv6.conf
|
||||
- logging_ipv4.conf
|
||||
- logging_ipv6.conf
|
||||
- post_declarations.conf
|
||||
when:
|
||||
- git_firewall_repository is defined and git_firewall_repository|length > 0
|
||||
- diff_script_output.changed
|
||||
# notify:
|
||||
# - Restart IPv4 Firewall
|
||||
# - Restart IPv6 Firewall
|
||||
|
||||
|
||||
|
||||
# ===
|
||||
# Firewall scripts
|
||||
# ===
|
||||
|
||||
- name: Check if firewall scripts are latest
|
||||
shell: 'diff {{ git_firewall_repository.dest }}/{{ item }} /usr/local/sbin/{{ item }} > /dev/null 2>&1'
|
||||
changed_when: "diff_script_output.rc > 0"
|
||||
# diff_output.rc
|
||||
# 0 -> unchanged
|
||||
# 1 -> changed
|
||||
# 2 -> not present
|
||||
failed_when: "diff_script_output.rc > 2"
|
||||
when:
|
||||
- git_firewall_repository is defined and git_firewall_repository|length > 0
|
||||
loop:
|
||||
- ipt-firewall-server
|
||||
- ip6t-firewall-server
|
||||
register: diff_script_output
|
||||
|
||||
- name: Ensure firewall scripts are latest
|
||||
command: cp {{ git_firewall_repository.dest }}/{{ item }} /usr/local/sbin/{{ item }}
|
||||
loop:
|
||||
- ipt-firewall-server
|
||||
- ip6t-firewall-server
|
||||
when:
|
||||
- git_firewall_repository is defined and git_firewall_repository|length > 0
|
||||
- diff_script_output.changed
|
||||
# notify:
|
||||
# - Restart IPv4 Firewall
|
||||
# - Restart IPv6 Firewall
|
||||
|
||||
|
||||
|
||||
# ===
|
||||
# Delete files that are no longer required
|
||||
# ===
|
||||
|
||||
- name: Delete file '/etc/ipt-firewall/default_ports.conf' ..
|
||||
file:
|
||||
state: absent
|
||||
path: /etc/ipt-firewall/default_ports.conf
|
||||
|
||||
- name: Delete file '/etc/ipt-firewall/ports.conf' ..
|
||||
file:
|
||||
state: absent
|
||||
path: /etc/ipt-firewall/ports.conf
|
||||
|
||||
- name: Delete file '/etc/ipt-firewall/ports.conf' ..
|
||||
file:
|
||||
state: absent
|
||||
path: /etc/ipt-firewall/post_decalrations.conf
|
||||
|
||||
@@ -1,9 +0,0 @@
|
||||
---
|
||||
|
||||
- import_tasks: ipt-server.yml
|
||||
when:
|
||||
- inventory_hostname not in groups['gateway_server']
|
||||
- inventory_hostname not in groups['no_ipt_firewall']
|
||||
tags:
|
||||
- git-firewall-repository
|
||||
- ipt-server
|
||||
Reference in New Issue
Block a user