From ecc2ae2fbe9f5ee00c30d627e4925435b21f8930 Mon Sep 17 00:00:00 2001 From: Christoph Date: Wed, 4 Nov 2026 00:30:08 +0100 Subject: [PATCH] Role ipt-server: restart docker after a firewall restart; roll out to 18 hosts. - handlers: a firewall restart flushes the DOCKER* chains and docker's NAT rules; restart docker afterwards if it is running (like fail2ban). - host_vars: add values missing from host_vars generated by an older extract-fw-host-vars.py: - mm-irights, mm-nd, mm-rav: fw_mm_server_ips - test.mx: fw_mail_client_ips_v6, fw_dovecot_auth_service_v6, fw_mumble_server_ips_v6 - mm: fw_allow_local_service_v6 uses "," (the IPv6 script splits on ',', the IPv4 script on ':'). Rolled out to a.mx, a.ns, b.mx, b.ns, backup.warenform, cl-01, cl-02, cl-dissens, cl-flr, cl-irights, cl-nd-test, cl-ndm, mm, mm-irights, mm-nd, mm-rav, o45, test.mx; second run changed=0 on all of them. Co-Authored-By: Claude Opus 5.5 --- .../mm-irights-ipt-server.yml | 3 +++ host_vars/mm-nd.oopen.de/mm-nd-ipt-server.yml | 3 +++ .../mm-rav.oopen.de/mm-rav-ipt-server.yml | 3 +++ host_vars/mm.oopen.de/mm-ipt-server.yml | 2 +- .../test.mx.oopen.de/test.mx-ipt-server.yml | 3 +++ roles/ipt-server/handlers/main.yml | 20 +++++++++++++++++-- 6 files changed, 31 insertions(+), 3 deletions(-) diff --git a/host_vars/mm-irights.oopen.de/mm-irights-ipt-server.yml b/host_vars/mm-irights.oopen.de/mm-irights-ipt-server.yml index db2b802..54e9d12 100644 --- a/host_vars/mm-irights.oopen.de/mm-irights-ipt-server.yml +++ b/host_vars/mm-irights.oopen.de/mm-irights-ipt-server.yml @@ -22,3 +22,6 @@ fw_http_server_ips: $ext_1_ip # --- Mail fw_mail_client_ips: $ext_1_ip + +# --- Mattermost +fw_mm_server_ips: $ext_1_ip diff --git a/host_vars/mm-nd.oopen.de/mm-nd-ipt-server.yml b/host_vars/mm-nd.oopen.de/mm-nd-ipt-server.yml index ceb4941..5c4fb95 100644 --- a/host_vars/mm-nd.oopen.de/mm-nd-ipt-server.yml +++ b/host_vars/mm-nd.oopen.de/mm-nd-ipt-server.yml @@ -22,3 +22,6 @@ fw_http_server_ips: $ext_1_ip # --- Mail fw_mail_client_ips: $ext_1_ip + +# --- Mattermost +fw_mm_server_ips: $ext_1_ip diff --git a/host_vars/mm-rav.oopen.de/mm-rav-ipt-server.yml b/host_vars/mm-rav.oopen.de/mm-rav-ipt-server.yml index 0b09d92..b541e41 100644 --- a/host_vars/mm-rav.oopen.de/mm-rav-ipt-server.yml +++ b/host_vars/mm-rav.oopen.de/mm-rav-ipt-server.yml @@ -22,3 +22,6 @@ fw_http_server_ips: $ext_1_ip # --- Mail fw_mail_client_ips: $ext_1_ip + +# --- Mattermost +fw_mm_server_ips: $ext_1_ip diff --git a/host_vars/mm.oopen.de/mm-ipt-server.yml b/host_vars/mm.oopen.de/mm-ipt-server.yml index c20c8ef..80b1e77 100644 --- a/host_vars/mm.oopen.de/mm-ipt-server.yml +++ b/host_vars/mm.oopen.de/mm-ipt-server.yml @@ -26,7 +26,7 @@ fw_unprotected_ifs: eth1 fw_allow_local_service_v4: "8065:tcp" # --- Access control IPv6 -fw_allow_local_service_v6: "8065:tcp" +fw_allow_local_service_v6: "8065,tcp" # --- HTTP fw_http_server_ips: $ext_1_ip diff --git a/host_vars/test.mx.oopen.de/test.mx-ipt-server.yml b/host_vars/test.mx.oopen.de/test.mx-ipt-server.yml index 4058368..e3ea08f 100644 --- a/host_vars/test.mx.oopen.de/test.mx-ipt-server.yml +++ b/host_vars/test.mx.oopen.de/test.mx-ipt-server.yml @@ -26,11 +26,14 @@ fw_http_server_ips: $ext_1_ip $ext_2_ip fw_smtpd_ips: $ext_1_ip fw_mail_server_ips: $ext_1_ip fw_mail_client_ips: $ext_1_ip $ext_2_ip +fw_mail_client_ips_v6: $ext_1_ip fw_dovecot_auth_service: true +fw_dovecot_auth_service_v6: false fw_dovecot_auth_allowed_networks_v4: 192.68.11.79 # --- Mumble fw_mumble_server_ips: 138.201.33.54 +fw_mumble_server_ips_v6: "2a01:4f8:171:3493::54" # --- Rsync fw_rsync_out_ips: $ext_1_ip diff --git a/roles/ipt-server/handlers/main.yml b/roles/ipt-server/handlers/main.yml index 00eb1e6..b912240 100644 --- a/roles/ipt-server/handlers/main.yml +++ b/roles/ipt-server/handlers/main.yml @@ -8,13 +8,17 @@ service: name: ipt-firewall state: restarted - notify: Restart fail2ban if active + notify: + - Restart fail2ban if active + - Restart docker if active - name: Restart IPv6 Firewall service: name: ip6t-firewall state: restarted - notify: Restart fail2ban if active + notify: + - Restart fail2ban if active + - Restart docker if active # A firewall restart flushes the fail2ban chains; restarting fail2ban # recreates them and re-applies the active bans. Does nothing if fail2ban @@ -27,3 +31,15 @@ fi register: fail2ban_restart changed_when: "'restarted' in fail2ban_restart.stdout" + +# A firewall restart also flushes the DOCKER* chains and the NAT rules of +# docker; restarting docker recreates them (and restarts the containers). +# Does nothing if docker is not installed or not running. +- name: Restart docker if active + shell: | + if systemctl is-active --quiet docker ; then + systemctl restart docker + echo restarted + fi + register: docker_restart + changed_when: "'restarted' in docker_restart.stdout"