Remove o13-web from no_ipt_firewall and add host_vars modelled on
o13-pad/o13-cryptpad (SSH, HTTP/HTTPS, outgoing mail, munin, blocked
networks).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
All ipt servers are now managed by the role ipt-server (playbook ipt-server.yml):
- roles/firewall: only handles gateways now.
- Remove playbook modify-ipt-server.yml and role modify-ipt-server.
- Remove git_firewall_repository (ipt-server) and the ipt-server entries of
git_{oopen,warenform}_server_repositories, so role common no longer
clones /usr/local/src/ipt-server. Gateways keep ipt-gateway.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
o13-git was removed from no_ipt_firewall (hosts, already in 57970a6).
h.mx gets the same dovecot auth networks as a.mx.
oolm-db.oopen.de is identical to o21.oopen.de.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
host_vars follow the current config on the host: add fw_mail_client_ips,
drop fw_blocked_ips_v4 (empty on the host). IPv4 rules unchanged; the old
IPv6 firewall had aborted halfway (policy ACCEPT), it is now complete.
Second run changed=0.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Sync ipt-firewall-server, ip6t-firewall-server and default_settings.conf
with firewall/ipt-server affa35d: new limit_new_tcp_connections_per_seconds_rate
(default 30, burst twice the rate); the rule now only drops SYNs above the
limit instead of accepting those below it; several IPv6 fixes.
- defaults: fw_limit_new_tcp_connections_per_seconds_per_source_IP: false,
fw_limit_new_tcp_connections_per_seconds_ports: "80,110,143,443,465,995",
new fw_limit_new_tcp_connections_per_seconds_rate (overridable with _v6).
- templates, extract-fw-host-vars.py, README: new variable and defaults.
- oolm-shop: drop fw_limit_new_tcp_connections_per_seconds_per_source_IP_v6
(it would have enabled the limit for IPv6 with the new default ports).
- piwik: fw_manage_config: true, per_IP_connection_limit 501, no
new-connection limit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- handlers: a firewall restart flushes the DOCKER* chains and docker's NAT
rules; restart docker afterwards if it is running (like fail2ban).
- host_vars: add values missing from host_vars generated by an older
extract-fw-host-vars.py:
- mm-irights, mm-nd, mm-rav: fw_mm_server_ips
- test.mx: fw_mail_client_ips_v6, fw_dovecot_auth_service_v6,
fw_mumble_server_ips_v6
- mm: fw_allow_local_service_v6 uses "<port>,<proto>" (the IPv6 script
splits on ',', the IPv4 script on ':').
Rolled out to a.mx, a.ns, b.mx, b.ns, backup.warenform, cl-01, cl-02,
cl-dissens, cl-flr, cl-irights, cl-nd-test, cl-ndm, mm, mm-irights, mm-nd,
mm-rav, o45, test.mx; second run changed=0 on all of them.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Previously "-l chris" was always passed, which overrode per-host users in
~/.ssh/config (e.g. the so36 hosts).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Without -o the script now writes the standard host_vars file (relative to
the script, independent of the cwd). An existing file is only overwritten
with --force; this is checked before connecting to the host. -o - prints
to stdout.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Previously an unreadable file (e.g. /etc/ipt-firewall is 0750 after the
role ran) silently produced almost empty host_vars. The script now exits
with an error and writes nothing. --from-dir reads the conf files from a
local directory, e.g. fetched with ansible using the vaulted become
password.
Add host_vars for cl-test.oopen.de (fw_manage_config: true).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A firewall restart flushes the fail2ban chains. The new handler restarts
fail2ban only if it is active; it does nothing if fail2ban is stopped or
not installed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Shared variables (and fw_ext_interfaces / fw_local_interfaces) can now be
overridden for IPv6 via <name>_v6. extract-fw-host-vars.py emits these
overrides when the IPv4 and IPv6 configs differ, instead of a warning.
Add host_vars for nd.warenform.de, oolm-shop.oopen.de, web-01.oopen.de
and web0.warenform.de (fw_manage_config: true).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Update firewall scripts and shared conf files from firewall/ipt-server
(HTTP connection limits, IPv6 TCP MSS clamping, ban_ipv6_mask,
mattermost TCP fallback, rename 'stansard_*' -> 'standard_*').
- New role variables: fw_set_max_new_http_conn_per_ip_per_second,
fw_max_http_new_conn_per_ip_per_second, fw_set_max_concurrent_http_conn_per_ip,
fw_max_concurrent_http_conn_per_ip, fw_set_max_new_http_conn_per_second,
fw_max_new_http_conn_per_second, fw_throttle_tcp6_mss_for_https,
fw_tcp6_mss_for_https_val, fw_mm_tcp_ports_in, fw_ban_ipv6_mask.
- Split fw_blocked_ips into fw_blocked_ips_v4 / fw_blocked_ips_v6 and
rename it in host_vars accordingly.
- Restart firewall when scripts or shared conf files change.
- extract-fw-host-vars.py: map new variables, normalize '${var}' and renamed
bash variables, fall back to IPv6 for shared variables and warn if IPv4
and IPv6 values differ.
- README.md / MIGRATION.md: document host_vars naming
(<short-hostname>-ipt-server.yml) and new variables.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Created a new configuration file for ga-al-gw-neu with detailed network interface settings and routing rules.
- Updated existing configurations for ga-al-gw, ga-gh-gw, ga-nh-gw, ga-st-gw-ersatz, ga-st-gw, and ga-st-mail to include additional DNS servers and correct domain controller IPs.
- Disabled systemd-resolved for ga-st-mail to prevent conflicts with DNS settings.
- Added user definitions and SSH key configurations for default users across multiple hosts.
chris
