--- # --- # Install/Uodate git firewall repository # --- - name: Install/update firewall repository git: repo: '{{ git_firewall_repository.repo }}' dest: '{{ git_firewall_repository.dest }}' when: git_firewall_repository is defined and git_firewall_repository|length > 0 # --- # Some Checks # --- - name: Check if file '/etc/ipt-firewall/main_ipv4.conf' exists stat: path: /etc/ipt-firewall/main_ipv4.conf register: main_ipv4_exists notify: - Restart IPv4 Firewall - name: Check if file '/etc/ipt-firewall/main_ipv6.conf' exists stat: path: /etc/ipt-firewall/main_ipv6.conf register: main_ipv6_exists notify: - Restart IPv6 Firewall - name: addjust line 'jitsi_tcp_ports' (IPv4) lineinfile: path: /etc/ipt-firewall/main_ipv4.conf regexp: '^jitsi_tcp_ports=' line: 'jitsi_tcp_ports="$standard_jitsi_tcp_ports"' notify: - Restart IPv4 Firewall - name: addjust line 'jitsi_tcp_ports' (IPv6) lineinfile: path: /etc/ipt-firewall/main_ipv6.conf regexp: '^jitsi_tcp_ports=' line: 'jitsi_tcp_ports="$standard_jitsi_tcp_ports"' when: - main_ipv6_exists.stat.exists notify: - Restart IPv6 Firewall - name: addjust line 'jitsi_udp_ports' (IPv4) lineinfile: path: /etc/ipt-firewall/main_ipv4.conf regexp: '^jitsi_udp_ports=' line: 'jitsi_udp_ports="$standard_jitsi_udp_port_range"' notify: - Restart IPv4 Firewall - name: addjust line 'jitsi_udp_ports' (IPv6) lineinfile: path: /etc/ipt-firewall/main_ipv6.conf regexp: '^jitsi_udp_ports=' line: 'jitsi_udp_ports="$standard_jitsi_udp_port_range"' when: - main_ipv6_exists.stat.exists notify: - Restart IPv6 Firewall # --- # allow_jitsi_video_conference_out # --- - name: Check if String 'allow_jitsi_video_conference_out..' (IPv4) is present shell: grep -q -E "^allow_jitsi_video_conference_out=" /etc/ipt-firewall/main_ipv4.conf register: jitsi_video_conference_out_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "jitsi_video_conference_out_ipv4_present.rc > 1" changed_when: "jitsi_video_conference_out_ipv4_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (jitsi) lineinfile: dest: /etc/ipt-firewall/main_ipv4.conf state: present regexp: '^allow_jitsi_video_conference_out' line: 'allow_jitsi_video_conference_out=true' insertafter: '^#?\s*allow_mumble_request_out' when: - main_ipv4_exists.stat.exists - jitsi_video_conference_out_ipv4_present is changed - name: Check if String 'allow_jitsi_video_conference_out..' (IPv6) is present shell: grep -q -E "^allow_jitsi_video_conference_out=" /etc/ipt-firewall/main_ipv6.conf register: jitsi_video_conference_out_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "jitsi_video_conference_out_ipv6_present.rc > 1" changed_when: "jitsi_video_conference_out_ipv6_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (jitsi) lineinfile: dest: /etc/ipt-firewall/main_ipv6.conf state: present regexp: '^allow_jitsi_video_conference_out' line: 'allow_jitsi_video_conference_out=true' insertafter: '^#?\s*allow_mumble_request_out' when: - main_ipv6_exists.stat.exists - jitsi_video_conference_out_ipv6_present is changed notify: - Restart IPv6 Firewall # --- # allow_nc_talk_out # --- - name: Check if String 'allow_nc_talk_out..' (IPv4) is present shell: grep -q -E "^allow_nc_talk_out=" /etc/ipt-firewall/main_ipv4.conf register: nc_talk_out_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "nc_talk_out_ipv4_present.rc > 1" changed_when: "nc_talk_out_ipv4_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (jitsi) lineinfile: dest: /etc/ipt-firewall/main_ipv4.conf state: present regexp: '^allow_nc_talk_out' line: 'allow_nc_talk_out=true' insertafter: '^#?\s*allow_jitsi_video_conference_out' when: - main_ipv4_exists.stat.exists - nc_talk_out_ipv4_present is changed - name: Check if String 'allow_nc_talk_out..' (IPv6) is present shell: grep -q -E "^allow_nc_talk_out=" /etc/ipt-firewall/main_ipv6.conf register: nc_talk_out_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "nc_talk_out_ipv6_present.rc > 1" changed_when: "nc_talk_out_ipv6_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (jitsi) lineinfile: dest: /etc/ipt-firewall/main_ipv6.conf state: present regexp: '^allow_nc_talk_out' line: 'allow_nc_talk_out=true' insertafter: '^#?\s*allow_jitsi_video_conference_out' when: - main_ipv6_exists.stat.exists - nc_talk_out_ipv6_present is changed # --- # allow_bigbluebutton_video_conference_out # --- - name: Check if String 'allow_bigbluebutton_video_conference_out..' (IPv4) is present shell: grep -q -E "^allow_bigbluebutton_video_conference_out=" /etc/ipt-firewall/main_ipv4.conf register: bigbluebutton_video_conference_out_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "bigbluebutton_video_conference_out_ipv4_present.rc > 1" changed_when: "bigbluebutton_video_conference_out_ipv4_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (bigbluebutton) lineinfile: dest: /etc/ipt-firewall/main_ipv4.conf state: present regexp: '^allow_bigbluebutton_video_conference_out' line: 'allow_bigbluebutton_video_conference_out=true' insertafter: '^#?\s*allow_mumble_request_out' when: - main_ipv4_exists.stat.exists - bigbluebutton_video_conference_out_ipv4_present is changed - name: Check if String 'allow_bigbluebutton_video_conference_out..' (IPv6) is present shell: grep -q -E "^allow_bigbluebutton_video_conference_out=" /etc/ipt-firewall/main_ipv6.conf register: bigbluebutton_video_conference_out_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "bigbluebutton_video_conference_out_ipv6_present.rc > 1" changed_when: "bigbluebutton_video_conference_out_ipv6_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (bigbluebutton) lineinfile: dest: /etc/ipt-firewall/main_ipv6.conf state: present regexp: '^allow_bigbluebutton_video_conference_out' line: 'allow_bigbluebutton_video_conference_out=true' insertafter: '^#?\s*allow_mumble_request_out' when: - main_ipv6_exists.stat.exists - bigbluebutton_video_conference_out_ipv6_present is changed # --- # jitsi video conference service # --- - name: Check if String 'jitsi_tcp_ports=..' (IPv4) is present shell: grep -q -E "^jitsi_tcp_ports=" /etc/ipt-firewall/main_ipv4.conf register: jitsi_service_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "jitsi_service_ipv4_present.rc > 1" changed_when: "jitsi_service_ipv4_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (jitsi service) blockinfile: path: /etc/ipt-firewall/main_ipv4.conf insertafter: '^#?\s*mumble_ports' block: | # ====== # - Jitsi Video Conference Service # ====== # - Jitsi Video Conference Service Gateway # - # - NOT YET IMPLEMENTED # - local_jitsi_video_conference_service=false # - Jitsi Video Conference Service Ports # - # - TCP 80: Webinterface. # - TCP 443: Webinterface (SSL) # - # - UDP 10000-20000: Virtual Media for Remote Console # - jitsi_tcp_ports="$standard_jitsi_tcp_ports" jitsi_udp_ports="$standard_jitsi_udp_port_range" marker: "# Marker set by modify-ipt-gateway.yml (jitsi service)" when: - main_ipv4_exists.stat.exists - jitsi_service_ipv4_present is changed - name: Check if String 'jitsi_tcp_ports=..' (IPv6) is present shell: grep -q -E "^jitsi_tcp_ports=" /etc/ipt-firewall/main_ipv6.conf register: jitsi_service_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "jitsi_service_ipv6_present.rc > 1" changed_when: "jitsi_service_ipv6_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (jitsi service) blockinfile: path: /etc/ipt-firewall/main_ipv6.conf insertafter: '^#?\s*mumble_ports' block: | # ====== # - Jitsi Video Conference Service # ====== # - Jitsi Video Conference Service Gateway # - # - NOT YET IMPLEMENTED # - local_jitsi_video_conference_service=false # - Jitsi Video Conference Service Ports # - # - TCP 80: Webinterface. # - TCP 443: Webinterface (SSL) # - # - UDP 10000-20000: Virtual Media for Remote Console # - jitsi_tcp_ports="$standard_jitsi_tcp_ports" jitsi_udp_ports="$standard_jitsi_udp_port_range" marker: "# Marker set by modify-ipt-gateway.yml (jitsi service)" when: - main_ipv6_exists.stat.exists - jitsi_service_ipv6_present is changed # --- # TURN Server (Stun Server) (for Nextcloud 'talk' app) # --- - name: Check if String 'nc_turn_ports=..' (IPv4) is present shell: grep -q -E "^nc_turn_ports=" /etc/ipt-firewall/main_ipv4.conf register: nc_turn_service_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "nc_turn_service_ipv4_present.rc > 1" changed_when: "nc_turn_service_ipv4_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (nc's turn service) blockinfile: path: /etc/ipt-firewall/main_ipv4.conf insertafter: '^#?\s*jitsi_udp_ports' block: | # ====== # - TURN Server (Stun Server) (for Nextcloud 'talk' app) # ====== # - TURN Server (Stun Server) (for Nextcloud 'talk' app) # - # - NOT YET IMPLEMENTED # - local_nc_turn_service="" # - Ports used by local TURN Server (Stun Server) # - # - comma separated list # - nc_turn_ports="$standard_turn_service_ports" nc_turn_udp_ports="$standard_turn_service_udp_ports" marker: "# Marker set by modify-ipt-gateway.yml (nc's turn service)" when: - main_ipv4_exists.stat.exists - nc_turn_service_ipv4_present is changed - name: Check if String 'nc_turn_ports=..' (IPv6) is present shell: grep -q -E "^nc_turn_ports=" /etc/ipt-firewall/main_ipv6.conf register: nc_turn_service_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "nc_turn_service_ipv6_present.rc > 1" changed_when: "nc_turn_service_ipv6_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (jitsi service) blockinfile: path: /etc/ipt-firewall/main_ipv6.conf insertafter: '^#?\s*jitsi_udp_ports' block: | # ====== # - TURN Server (Stun Server) (for Nextcloud 'talk' app) # ====== # - TURN Server (Stun Server) (for Nextcloud 'talk' app) # - # - NOT YET IMPLEMENTED # - local_nc_turn_service="" # - Ports used by local TURN Server (Stun Server) # - # - comma separated list # - nc_turn_ports="$standard_turn_service_ports" nc_turn_udp_ports="$standard_turn_service_udp_ports" marker: "# Marker set by modify-ipt-gateway.yml (jitsi service)" when: - main_ipv6_exists.stat.exists - nc_turn_service_ipv6_present is changed # --- # BigBlueButton video conference service # --- - name: Check if String 'bigbluebutton_tcp_ports=..' (IPv4) is present shell: grep -q -E "^bigbluebutton_tcp_ports=" /etc/ipt-firewall/main_ipv4.conf register: bigbluebutton_service_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "bigbluebutton_service_ipv4_present.rc > 1" changed_when: "bigbluebutton_service_ipv4_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (bigbluebutton service) blockinfile: path: /etc/ipt-firewall/main_ipv4.conf insertafter: '^#?\s*mumble_ports' block: | # ====== # - BigBlueButton Video Conference Service # ====== # - BigBlueButton Video Conference Service Gateway # - # - NOT YET IMPLEMENTED # - local_bigbluebutton_video_conference_service=false # - BigBlueButton Video Conference Service Ports # - # - TCP 80: Webinterface. # - TCP 443: Webinterface (SSL) # - # - UDP 16384-32768: FreeSWITCH/HTML5 RTP streams # - bigbluebutton_tcp_ports="$standard_bigbluebutton_tcp_ports" bigbluebutton_udp_ports="$standard_bigbluebutton_udp_port_range" marker: "# Marker set by modify-ipt-gateway.yml (bigbluebutton service)" when: - main_ipv4_exists.stat.exists - bigbluebutton_service_ipv4_present is changed - name: Check if String 'bigbluebutton_tcp_ports=..' (IPv6) is present shell: grep -q -E "^bigbluebutton_tcp_ports=" /etc/ipt-firewall/main_ipv6.conf register: bigbluebutton_service_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "bigbluebutton_service_ipv6_present.rc > 1" changed_when: "bigbluebutton_service_ipv6_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (bigbluebutton service) blockinfile: path: /etc/ipt-firewall/main_ipv6.conf insertafter: '^#?\s*mumble_ports' block: | # ====== # - BigBlueButton Video Conference Service # ====== # - BigBlueButton Video Conference Service Gateway # - # - NOT YET IMPLEMENTED # - local_bigbluebutton_video_conference_service=false # - BigBlueButton Video Conference Service Ports # - # - TCP 80: Webinterface. # - TCP 443: Webinterface (SSL) # - # - UDP 16384-32768: FreeSWITCH/HTML5 RTP streams # - bigbluebutton_tcp_ports="$standard_bigbluebutton_tcp_ports" bigbluebutton_udp_ports="$standard_bigbluebutton_udp_port_range" marker: "# Marker set by modify-ipt-gateway.yml (bigbluebutton service)" when: - main_ipv6_exists.stat.exists - bigbluebutton_service_ipv6_present is changed # --- # Remove Marker set by blockinfile # --- - name: Remove marker IPv4 replace : path: /etc/ipt-firewall/main_ipv4.conf regexp: "^# Marker set by modify-ipt-gateway.yml.*$" replace: "" register: marker_ipv4_removed #failed_when: "marker_ipv4_removed.rc > 1" #changed_when: "marker_ipv4_removed.rc < 1" when: - main_ipv4_exists.stat.exists - name: Remove marker IPv6 replace : path: /etc/ipt-firewall/main_ipv6.conf regexp: "^# Marker set by modify-ipt-gateway.yml.*$" replace: "" register: marker_ipv6_removed #failed_when: "marker_ipv6_removed.rc > 1" #changed_when: "marker_ipv6_removed.rc < 1" when: - main_ipv6_exists.stat.exists # --- # Confiuration Files # --- - name: Check if configuration files are latest shell: 'diff {{ git_firewall_repository.dest }}/conf/{{ item }} /etc/ipt-firewall/{{ item }} > /dev/null 2>&1' changed_when: "diff_script_output.rc > 0" # diff_output.rc # 0 -> unchanged # 1 -> changed # 2 -> not present failed_when: "diff_script_output.rc > 2" when: git_firewall_repository is defined and git_firewall_repository > 0 loop: - default_ports.conf - include_functions.conf - load_modules_ipv4.conf - load_modules_ipv6.conf - logging_ipv4.conf - logging_ipv6.conf - post_decalrations.conf register: diff_script_output - name: Ensure configuration files are latest command: cp {{ git_firewall_repository.dest }}/conf/{{ item }} /etc/ipt-firewall/{{ item }} loop: - default_ports.conf - include_functions.conf - load_modules_ipv4.conf - load_modules_ipv6.conf - logging_ipv4.conf - logging_ipv6.conf - post_decalrations.conf when: - git_firewall_repository is defined and git_firewall_repository > 0 - diff_script_output.changed notify: - Restart IPv4 Firewall - Restart IPv6 Firewall # --- # Firewall scripts # --- - name: Check if firewall scripts are latest shell: 'diff {{ git_firewall_repository.dest }}/{{ item }} /usr/local/sbin/{{ item }} > /dev/null 2>&1' changed_when: "diff_script_output.rc > 0" # diff_output.rc # 0 -> unchanged # 1 -> changed # 2 -> not present failed_when: "diff_script_output.rc > 2" when: git_firewall_repository is defined and git_firewall_repository > 0 loop: - ipt-firewall-gateway - ip6t-firewall-gateway register: diff_script_output - name: Ensure firewall scripts are latest command: cp {{ git_firewall_repository.dest }}/{{ item }} /usr/local/sbin/{{ item }} loop: - ipt-firewall-gateway - ip6t-firewall-gateway when: - git_firewall_repository is defined and git_firewall_repository > 0 - diff_script_output.changed notify: - Restart IPv4 Firewall - Restart IPv6 Firewall