Role ipt-server: restart docker after a firewall restart; roll out to 18 hosts.

- handlers: a firewall restart flushes the DOCKER* chains and docker's NAT
  rules; restart docker afterwards if it is running (like fail2ban).
- host_vars: add values missing from host_vars generated by an older
  extract-fw-host-vars.py:
  - mm-irights, mm-nd, mm-rav: fw_mm_server_ips
  - test.mx: fw_mail_client_ips_v6, fw_dovecot_auth_service_v6,
    fw_mumble_server_ips_v6
  - mm: fw_allow_local_service_v6 uses "<port>,<proto>" (the IPv6 script
    splits on ',', the IPv4 script on ':').

Rolled out to a.mx, a.ns, b.mx, b.ns, backup.warenform, cl-01, cl-02,
cl-dissens, cl-flr, cl-irights, cl-nd-test, cl-ndm, mm, mm-irights, mm-nd,
mm-rav, o45, test.mx; second run changed=0 on all of them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

host_vars/mm-irights.oopen.de/mm-irights-ipt-server.yml

@@ -22,3 +22,6 @@ fw_http_server_ips: $ext_1_ip
 
 # --- Mail
 fw_mail_client_ips: $ext_1_ip
+
+# --- Mattermost
+fw_mm_server_ips: $ext_1_ip

host_vars/mm-nd.oopen.de/mm-nd-ipt-server.yml

@@ -22,3 +22,6 @@ fw_http_server_ips: $ext_1_ip
 
 # --- Mail
 fw_mail_client_ips: $ext_1_ip
+
+# --- Mattermost
+fw_mm_server_ips: $ext_1_ip

host_vars/mm-rav.oopen.de/mm-rav-ipt-server.yml

@@ -22,3 +22,6 @@ fw_http_server_ips: $ext_1_ip
 
 # --- Mail
 fw_mail_client_ips: $ext_1_ip
+
+# --- Mattermost
+fw_mm_server_ips: $ext_1_ip

host_vars/mm.oopen.de/mm-ipt-server.yml

@@ -26,7 +26,7 @@ fw_unprotected_ifs: eth1
 fw_allow_local_service_v4: "8065:tcp"
 
 # --- Access control IPv6
-fw_allow_local_service_v6: "8065:tcp"
+fw_allow_local_service_v6: "8065,tcp"
 
 # --- HTTP
 fw_http_server_ips: $ext_1_ip

host_vars/test.mx.oopen.de/test.mx-ipt-server.yml

@@ -26,11 +26,14 @@ fw_http_server_ips: $ext_1_ip $ext_2_ip
 fw_smtpd_ips: $ext_1_ip
 fw_mail_server_ips: $ext_1_ip
 fw_mail_client_ips: $ext_1_ip $ext_2_ip
+fw_mail_client_ips_v6: $ext_1_ip
 fw_dovecot_auth_service: true
+fw_dovecot_auth_service_v6: false
 fw_dovecot_auth_allowed_networks_v4: 192.68.11.79
 
 # --- Mumble
 fw_mumble_server_ips: 138.201.33.54
+fw_mumble_server_ips_v6: "2a01:4f8:171:3493::54"
 
 # --- Rsync
 fw_rsync_out_ips: $ext_1_ip

roles/ipt-server/handlers/main.yml

@@ -8,13 +8,17 @@
   service:
     name: ipt-firewall
     state: restarted
-  notify: Restart fail2ban if active
+  notify:
+    - Restart fail2ban if active
+    - Restart docker if active
 
 - name: Restart IPv6 Firewall
   service:
     name: ip6t-firewall
     state: restarted
-  notify: Restart fail2ban if active
+  notify:
+    - Restart fail2ban if active
+    - Restart docker if active
 
 # A firewall restart flushes the fail2ban chains; restarting fail2ban
 # recreates them and re-applies the active bans. Does nothing if fail2ban
@@ -27,3 +31,15 @@
     fi
   register: fail2ban_restart
   changed_when: "'restarted' in fail2ban_restart.stdout"
+
+# A firewall restart also flushes the DOCKER* chains and the NAT rules of
+# docker; restarting docker recreates them (and restarts the containers).
+# Does nothing if docker is not installed or not running.
+- name: Restart docker if active
+  shell: |
+    if systemctl is-active --quiet docker ; then
+       systemctl restart docker
+       echo restarted
+    fi
+  register: docker_restart
+  changed_when: "'restarted' in docker_restart.stdout"