Previously an unreadable file (e.g. /etc/ipt-firewall is 0750 after the
role ran) silently produced almost empty host_vars. The script now exits
with an error and writes nothing. --from-dir reads the conf files from a
local directory, e.g. fetched with ansible using the vaulted become
password.
Add host_vars for cl-test.oopen.de (fw_manage_config: true).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Shared variables (and fw_ext_interfaces / fw_local_interfaces) can now be
overridden for IPv6 via <name>_v6. extract-fw-host-vars.py emits these
overrides when the IPv4 and IPv6 configs differ, instead of a warning.
Add host_vars for nd.warenform.de, oolm-shop.oopen.de, web-01.oopen.de
and web0.warenform.de (fw_manage_config: true).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Update firewall scripts and shared conf files from firewall/ipt-server
(HTTP connection limits, IPv6 TCP MSS clamping, ban_ipv6_mask,
mattermost TCP fallback, rename 'stansard_*' -> 'standard_*').
- New role variables: fw_set_max_new_http_conn_per_ip_per_second,
fw_max_http_new_conn_per_ip_per_second, fw_set_max_concurrent_http_conn_per_ip,
fw_max_concurrent_http_conn_per_ip, fw_set_max_new_http_conn_per_second,
fw_max_new_http_conn_per_second, fw_throttle_tcp6_mss_for_https,
fw_tcp6_mss_for_https_val, fw_mm_tcp_ports_in, fw_ban_ipv6_mask.
- Split fw_blocked_ips into fw_blocked_ips_v4 / fw_blocked_ips_v6 and
rename it in host_vars accordingly.
- Restart firewall when scripts or shared conf files change.
- extract-fw-host-vars.py: map new variables, normalize '${var}' and renamed
bash variables, fall back to IPv6 for shared variables and warn if IPv4
and IPv6 values differ.
- README.md / MIGRATION.md: document host_vars naming
(<short-hostname>-ipt-server.yml) and new variables.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Created handlers for reloading systemd and restarting firewall services.
- Implemented tasks to ensure the existence of configuration directories and files.
- Deployed host-specific and shared configuration files using templates.
- Added scripts for managing IPv4 and IPv6 firewalls.
- Configured systemd service units for ipt-firewall and ip6t-firewall.
- Enabled and started firewall services on system boot.
chrisandClaude Opus 5.5