Role ipt-server: restart docker after a firewall restart; roll out to 18 hosts.

- handlers: a firewall restart flushes the DOCKER* chains and docker's NAT
  rules; restart docker afterwards if it is running (like fail2ban).
- host_vars: add values missing from host_vars generated by an older
  extract-fw-host-vars.py:
  - mm-irights, mm-nd, mm-rav: fw_mm_server_ips
  - test.mx: fw_mail_client_ips_v6, fw_dovecot_auth_service_v6,
    fw_mumble_server_ips_v6
  - mm: fw_allow_local_service_v6 uses "<port>,<proto>" (the IPv6 script
    splits on ',', the IPv4 script on ':').

Rolled out to a.mx, a.ns, b.mx, b.ns, backup.warenform, cl-01, cl-02,
cl-dissens, cl-flr, cl-irights, cl-nd-test, cl-ndm, mm, mm-irights, mm-nd,
mm-rav, o45, test.mx; second run changed=0 on all of them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

This commit is contained in:

chris

2026-11-04 00:30:08 +01:00

co-authored by

Claude Opus 5.5

parent f14b8817c0

commit ecc2ae2fbe

6 changed files with 31 additions and 3 deletions

									
										host_vars/mm.oopen.de/mm-ipt-server.yml
									
		+1
		-1
	
												View File
												
				@@ -26,7 +26,7 @@ fw_unprotected_ifs: eth1

				fw_allow_local_service_v4: "8065:tcp"

				# --- Access control IPv6

				fw_allow_local_service_v6: "8065:tcp"

				fw_allow_local_service_v6: "8065,tcp"

				# --- HTTP

				fw_http_server_ips: $ext_1_ip