feat(ipt-firewall): add ipt-firewall configuration for mm-irights, mm-nd, and mm-rav hosts

host_vars/mm-irights.oopen.de/mm-irights-ipt-server.yml

@@ -0,0 +1,24 @@
+---
+# ipt-firewall configuration for a.ns.oopen.de
+# Generated by extract-fw-host-vars.py - review before committing!
+# Place in: host_vars/<hostname>/ipt_firewall.yml
+
+fw_manage_config: true
+
+# --- Network
+fw_ext_interfaces:
+  - "eth0"
+fw_ext_ips_v4:
+  - "157.90.140.169"
+fw_ext_ips_v6:
+  - "2a01:4f8:2220:37c3::169"
+
+# --- Munin
+munin_remote_ipv4: 37.27.121.227
+munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
+
+# --- HTTP
+fw_http_server_ips: $ext_1_ip
+
+# --- Mail
+fw_mail_client_ips: $ext_1_ip

host_vars/mm-nd.oopen.de/mm-nd-common.yml

@@ -171,6 +171,24 @@ cron_user_entries:
 # vars used by roles/common/tasks/webadmin-user.yml
 # ---
 
+extra_user:
+
+  - name: nd-admin
+    user_id: 1045
+    group_id: 1045
+    group: nd-admin
+    password: $y$j9T$1YJwHY0qdLimgtdOKlTxR1$/O9QWTpr0Y41TduR2GZ0FMCiIxFqOaXWSM9hmHRnv80
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKTjd4XFBdF/V9VdSZjy9G7nupBwaMqsrtQSP4Uctkrz org@rdsgn.de'
+
+sudo_users:
+  - chris
+  - sysadm
+  - nd-admin
+
 
 # ---
 # vars used by roles/common/tasks/sudoers.yml

host_vars/mm-nd.oopen.de/mm-nd-ipt-server.yml

@@ -0,0 +1,24 @@
+---
+# ipt-firewall configuration for a.ns.oopen.de
+# Generated by extract-fw-host-vars.py - review before committing!
+# Place in: host_vars/<hostname>/ipt_firewall.yml
+
+fw_manage_config: true
+
+# --- Network
+fw_ext_interfaces:
+  - "eth0"
+fw_ext_ips_v4:
+  - "135.181.239.139"
+fw_ext_ips_v6:
+  - "2a01:4f9:3080:3d2d::139"
+
+# --- Munin
+munin_remote_ipv4: 37.27.121.227
+munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
+
+# --- HTTP
+fw_http_server_ips: $ext_1_ip
+
+# --- Mail
+fw_mail_client_ips: $ext_1_ip

host_vars/mm-rav.oopen.de/mm-rav-ipt-server.yml

@@ -0,0 +1,24 @@
+---
+# ipt-firewall configuration for a.ns.oopen.de
+# Generated by extract-fw-host-vars.py - review before committing!
+# Place in: host_vars/<hostname>/ipt_firewall.yml
+
+fw_manage_config: true
+
+# --- Network
+fw_ext_interfaces:
+  - "eth0"
+fw_ext_ips_v4:
+  - "95.217.194.17"
+fw_ext_ips_v6:
+  - "2a01:4f9:4a:5114::17"
+
+# --- Munin
+munin_remote_ipv4: 37.27.121.227
+munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
+
+# --- HTTP
+fw_http_server_ips: $ext_1_ip
+
+# --- Mail
+fw_mail_client_ips: $ext_1_ip

host_vars/mm.oopen.de/mm-ipt-server.yml

@@ -0,0 +1,41 @@
+---
+# ipt-firewall configuration for a.ns.oopen.de
+# Generated by extract-fw-host-vars.py - review before committing!
+# Place in: host_vars/<hostname>/ipt_firewall.yml
+
+fw_manage_config: true
+
+# --- Network
+fw_ext_interfaces:
+  - "eth0"
+fw_ext_ips_v4:
+  - "159.69.74.147"
+fw_ext_ips_v6:
+  - "2a01:4f8:231:19a7::147"
+fw_local_interfaces:
+  - "eth1"
+
+# --- Munin
+munin_remote_ipv4: 37.27.121.227
+munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
+
+# --- Outgoing / interfaces
+fw_unprotected_ifs: eth1
+
+# --- Access control IPv4
+fw_allow_local_service_v4: "8065:tcp"
+
+# --- Access control IPv6
+fw_allow_local_service_v6: "8065:tcp"
+
+# --- HTTP
+fw_http_server_ips: $ext_1_ip
+
+# --- Mail
+fw_mail_client_ips: $ext_1_ip
+
+# --- Mattermost
+fw_mm_server_ips: $ext_1_ip
+
+# --- Protection / limits
+fw_limit_connections_per_source_IP: false

host_vars/o45.oopen.de/o45-ipt-server.yml

@@ -32,5 +32,4 @@ fw_do_not_firewall_lx_guest_systems: true
 
 # --- Forwarding
 fw_kernel_activate_forwarding: true
-fw_kernel_forward_between_interfaces: true
-
+fw_kernel_forward_between_interfaces: true