--- - hosts: all tasks: # # --- # # - Check if firewall repository exist # # --- # # - name: Check if firewall repository exist # stat: # path: '{{ git_firewall_repository.dest }}' # register: git_firewall_repository_exists # # - meta: end_host # when: not git_firewall_repository_exists.stat.exists # --- # Create firewall config directory '/etc/ipt/firewall' if not exists # --- - name: Install/update firewall repository git: repo: '{{ git_firewall_repository.repo }}' dest: '{{ git_firewall_repository.dest }}' when: git_firewall_repository is defined and git_firewall_repository|length > 0 tags: - git-firewall-repository # Exit if no firewall repository variable does not exists or is empty # - meta: end_host when: git_firewall_repository is not defined or git_firewall_repository|length < 1 - name: Create directory /etc/ipt-firewall if not exists file: path: /etc/ipt-firewall state: directory # --- # Check presence of files # --- - name: Check if /etc/ipt-firewall/interfaces_ipv4.conf are present stat: path: /etc/ipt-firewall/interfaces_ipv4.conf register: interfaces_ipv4_exists - name: Check if /etc/ipt-firewall/interfaces_ipv6.conf are present stat: path: /etc/ipt-firewall/interfaces_ipv6.conf register: interfaces_ipv6_exists - name: Check if file '/etc/ipt-firewall/main_ipv4.conf' exists stat: path: /etc/ipt-firewall/main_ipv4.conf register: main_ipv4_exists - name: Check if file '/etc/ipt-firewall/main_ipv6.conf' exists stat: path: /etc/ipt-firewall/main_ipv6.conf register: main_ipv6_exists - name: Check if /etc/ipt-firewall/ban_ipv4.list are present stat: path: /etc/ipt-firewall/ban_ipv4.list register: ban_ipv4_exists - name: Check if /etc/ipt-firewall/ban_ipv6.list are present stat: path: /etc/ipt-firewall/ban_ipv6.list register: ban_ipv6_exists # --- # Get information about network devices # --- - name: define traditional ethernet facts set_fact: ansible_netdev: "{% set ansible_netdev = ansible_netdev|default([]) + [hostvars[inventory_hostname]['ansible_' + item]] %}{{ ansible_netdev|list }}" when: - not interfaces_ipv4_exists.stat.exists - hostvars[inventory_hostname]['ansible_' + item]['type'] is defined - hostvars[inventory_hostname]['ansible_' + item]['type'] == 'ether' - inventory_hostname not in groups['lxc_host']|string with_items: - "{{ hostvars[inventory_hostname]['ansible_interfaces'] }}" - name: define traditional bridge facts set_fact: ansible_netdev: "{% set ansible_netdev = ansible_netdev|default([]) + [hostvars[inventory_hostname]['ansible_' + item]] %}{{ ansible_netdev|list }}" when: - not interfaces_ipv4_exists.stat.exists - hostvars[inventory_hostname]['ansible_' + item]['type'] is defined - hostvars[inventory_hostname]['ansible_' + item]['type'] == 'bridge' - "groups['lxc_host']|string is search(inventory_hostname)" with_items: - "{{ hostvars[inventory_hostname]['ansible_interfaces'] }}" - name: Debug message IPv4 debug: msg: - "index: {{ idx + 1 }}" - "device: {{ item.device }}" - "ipv4-address: {{ item.ipv4.address }}" loop: "{{ ansible_netdev }}" loop_control: label: "{{ item.device }}" index_var: idx when: - item.ipv4.address is defined and item.ipv4.address|length > 0 - name: Debug message IPv6 debug: msg: - "index: {{ idx + 1 }}" - "device: {{ item.device }}" - "ipv6-address: {{ item.ipv6.0.address }}{{ (item.ipv6.1.address is match 'f.*') | ternary('', ' ' + item.ipv6.1.address) }}" loop: "{{ ansible_netdev }}" loop_control: label: "{{ item.device }}" index_var: idx when: - item.ipv6.0.address is defined and item.ipv6.0.address|length > 0 # - meta: end_host # --- # Get sshd ports # --- - name: Get sshd ports as blank separated list set_fact: fw_sshd_ports: "{{ sshd_ports | join (' ') }}" when: - sshd_ports is defined and sshd_ports | length > 0 - sshd_ports|join() != "22" - name: Set default sshd ports set_fact: fw_sshd_ports: "$standard_ssh_port" when: - sshd_ports is not defined or sshd_ports | length == 0 or sshd_ports|join() == "22" # === # Modify main_ipv[4|].conf - add port definitionios # === # --- # vpn_ports # --- - name: Check if String 'vpn_ports=..' is present shell: grep -q -E "^vpn_ports=" /etc/ipt-firewall/main_ipv4.conf register: vpn_ports_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "vpn_ports_ipv4_present.rc > 1" changed_when: "vpn_ports_ipv4_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (vpn_ports) blockinfile: path: /etc/ipt-firewall/main_ipv4.conf insertafter: '^#?\s*forward_vpn_server_ips' block: | # - VPN Port(s) used by local Services # - # - blank separated list # - vpn_ports="$standard_vpn_port" marker: "# Marker set by modify-ipt-server.yml (vpn_ports)" when: - main_ipv4_exists.stat.exists - vpn_ports_ipv4_present is changed notify: - Restart IPv4 Firewall - name: Check if String 'vpn_ports=..' is present shell: grep -q -E "^vpn_ports=" /etc/ipt-firewall/main_ipv6.conf register: vpn_ports_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "vpn_ports_ipv6_present.rc > 1" changed_when: "vpn_ports_ipv6_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (vpn_ports) blockinfile: path: /etc/ipt-firewall/main_ipv6.conf insertafter: '^#?\s*forward_vpn_server_ips' block: | # - VPN Port(s) used by local Services # - # - blank separated list # - vpn_ports="$standard_vpn_port" marker: "# Marker set by modify-ipt-server.yml (vpn_ports)" when: - main_ipv6_exists.stat.exists - vpn_ports_ipv6_present is changed notify: - Restart IPv6 Firewall # --- # ssh_ports # --- - name: Check if String 'ssh_ports=..' is present shell: grep -q -E "^ssh_ports=" /etc/ipt-firewall/main_ipv4.conf register: ssh_ports_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "ssh_ports_ipv4_present.rc > 1" changed_when: "ssh_ports_ipv4_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (ssh_ports) blockinfile: path: /etc/ipt-firewall/main_ipv4.conf insertafter: '^#?\s*forward_ssh_server_ips' block: | # - SSH Port(s) used by local Services # - # - blank separated list # - ssh_ports="{{ fw_sshd_ports }}" marker: "# Marker set by modify-ipt-server.yml (ssh_ports)" when: - main_ipv4_exists.stat.exists - ssh_ports_ipv4_present is changed notify: - Restart IPv4 Firewall - name: Check if String 'ssh_ports=..' is present shell: grep -q -E "^ssh_ports=" /etc/ipt-firewall/main_ipv6.conf register: ssh_ports_ipv6_present when: main_ipv6_exists.stat.exists failed_when: "ssh_ports_ipv6_present.rc > 1" changed_when: "ssh_ports_ipv6_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (ssh_ports) blockinfile: path: /etc/ipt-firewall/main_ipv6.conf insertafter: '^#?\s*forward_ssh_server_ips' block: | # - SSH Port(s) used by local Services # - # - blank separated list # - ssh_ports="{{ fw_sshd_ports }}" marker: "# Marker set by modify-ipt-server.yml (ssh_ports)" when: - main_ipv6_exists.stat.exists - ssh_ports_ipv6_present is changed notify: - Restart IPv6 Firewall # --- # http_ports # --- - name: Check if String 'http_ports=..' is present shell: grep -q -E "^http_ports=" /etc/ipt-firewall/main_ipv4.conf register: http_ports_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "http_ports_ipv4_present.rc > 1" changed_when: "http_ports_ipv4_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (http_ports) blockinfile: path: /etc/ipt-firewall/main_ipv4.conf insertafter: '^#?\s*forward_http_server_ips' block: | # - HTTP(S) Ports used by local Services # - # - comma separated list # - http_ports="$standard_http_ports" marker: "# Marker set by modify-ipt-server.yml (http_ports)" when: - main_ipv4_exists.stat.exists - http_ports_ipv4_present is changed notify: - Restart IPv4 Firewall - name: Check if String 'http_ports=..' is present shell: grep -q -E "^http_ports=" /etc/ipt-firewall/main_ipv6.conf register: http_ports_ipv6_present when: main_ipv4_exists.stat.exists failed_when: "http_ports_ipv6_present.rc > 1" changed_when: "http_ports_ipv6_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (http_ports) blockinfile: path: /etc/ipt-firewall/main_ipv6.conf insertafter: '^#?\s*forward_http_server_ips' block: | # - HTTP(S) Ports used by local Services # - # - comma separated list # - http_ports="$standard_http_ports" marker: "# Marker set by modify-ipt-server.yml (http_ports)" when: - main_ipv6_exists.stat.exists - http_ports_ipv6_present is changed notify: - Restart IPv6 Firewall # --- # mail_user_ports # --- - name: Check if String 'mail_user_ports=..' is present shell: grep -q -E "^mail_user_ports=" /etc/ipt-firewall/main_ipv4.conf register: mail_user_ports_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "mail_user_ports_ipv4_present.rc > 1" changed_when: "mail_user_ports_ipv4_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (mail_user_ports) blockinfile: path: /etc/ipt-firewall/main_ipv4.conf insertafter: '^#?\s*forward_mail_server_ips' block: | # - Client Ports used by local Mail Services # - # - comma separated list # - mail_user_ports="$standard_mailuser_ports" marker: "# Marker set by modify-ipt-server.yml (mail_user_ports)" when: - main_ipv4_exists.stat.exists - mail_user_ports_ipv4_present is changed notify: - Restart IPv4 Firewall - name: Check if String 'mail_user_ports=..' is present shell: grep -q -E "^mail_user_ports=" /etc/ipt-firewall/main_ipv6.conf register: mail_user_ports_ipv6_present when: main_ipv4_exists.stat.exists failed_when: "mail_user_ports_ipv6_present.rc > 1" changed_when: "mail_user_ports_ipv6_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (mail_user_ports) blockinfile: path: /etc/ipt-firewall/main_ipv6.conf insertafter: '^#?\s*forward_mail_server_ips' block: | # - Client Ports used by local Mail Services # - # - comma separated list # - mail_user_ports="$standard_mailuser_ports" marker: "# Marker set by modify-ipt-server.yml (mail_user_ports)" when: - main_ipv6_exists.stat.exists - mail_user_ports_ipv6_present is changed notify: - Restart IPv6 Firewall # --- # ftp_passive_port_range # --- - name: Check if String 'ftp_passive_port_range=..' is present shell: grep -q -E "^ftp_passive_port_range=" /etc/ipt-firewall/main_ipv4.conf register: ftp_passive_port_range_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "ftp_passive_port_range_ipv4_present.rc > 1" changed_when: "ftp_passive_port_range_ipv4_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (ftp_passive_port_range) blockinfile: path: /etc/ipt-firewall/main_ipv4.conf insertafter: '^#?\s*forward_ftp_server_ips' block: | # - FTP passive port range use by local ftp service(s) # - # - example: ftp_passive_port_range="50000:50400" # - ftp_passive_port_range="50000:50400" marker: "# Marker set by modify-ipt-server.yml (ftp_passive_port_range)" when: - main_ipv4_exists.stat.exists - ftp_passive_port_range_ipv4_present is changed notify: - Restart IPv4 Firewall - name: Check if String 'ftp_passive_port_range=..' is present shell: grep -q -E "^ftp_passive_port_range=" /etc/ipt-firewall/main_ipv6.conf register: ftp_passive_port_range_ipv6_present when: main_ipv4_exists.stat.exists failed_when: "ftp_passive_port_range_ipv6_present.rc > 1" changed_when: "ftp_passive_port_range_ipv6_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (ftp_passive_port_range) blockinfile: path: /etc/ipt-firewall/main_ipv6.conf insertafter: '^#?\s*forward_ftp_server_ips' block: | # - FTP passive port range use by local ftp service(s) # - # - example: ftp_passive_port_range="50000:50400" # - ftp_passive_port_range="50000:50400" marker: "# Marker set by modify-ipt-server.yml (ftp_passive_port_range)" when: - main_ipv6_exists.stat.exists - ftp_passive_port_range_ipv6_present is changed notify: - Restart IPv6 Firewall # --- # munin_remote_port # --- - name: Check if String 'munin_remote_port=..' is present shell: grep -q -E "^munin_remote_port=" /etc/ipt-firewall/main_ipv4.conf register: munin_remote_port_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "munin_remote_port_ipv4_present.rc > 1" changed_when: "munin_remote_port_ipv4_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (munin_remote_port) blockinfile: path: /etc/ipt-firewall/main_ipv4.conf insertafter: '^#?\s*forward_munin_server_ips' block: | # - Port used by clients hosted on this (local) Munin Services # - # - !! Only one port is possible !! # - munin_remote_port="$standard_munin_port" marker: "# Marker set by modify-ipt-server.yml (munin_remote_port)" when: - main_ipv4_exists.stat.exists - munin_remote_port_ipv4_present is changed notify: - Restart IPv4 Firewall - name: Check if String 'munin_remote_port=..' is present shell: grep -q -E "^munin_remote_port=" /etc/ipt-firewall/main_ipv6.conf register: munin_remote_port_ipv6_present when: main_ipv4_exists.stat.exists failed_when: "munin_remote_port_ipv6_present.rc > 1" changed_when: "munin_remote_port_ipv6_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (munin_remote_port) blockinfile: path: /etc/ipt-firewall/main_ipv6.conf insertafter: '^#?\s*forward_munin_server_ips' block: | # - Ports used by clients hosted on this (local) Munin Services # - # - !! Only one port is possible !! # - munin_remote_port="$standard_munin_port" marker: "# Marker set by modify-ipt-server.yml (munin_remote_port)" when: - main_ipv6_exists.stat.exists - munin_remote_port_ipv6_present is changed notify: - Restart IPv6 Firewall # --- # xymon_port # --- - name: Check if String 'xymon_port=..' is present shell: grep -q -E "^xymon_port=" /etc/ipt-firewall/main_ipv4.conf register: xymon_port_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "xymon_port_ipv4_present.rc > 1" changed_when: "xymon_port_ipv4_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (xymon_port) blockinfile: path: /etc/ipt-firewall/main_ipv4.conf insertafter: '^#?\s*local_xymon_client' block: | # - Port used by local Xymon Services # - # - !! Only one port is possible !! # - xymon_port="$standard_xymon_port" marker: "# Marker set by modify-ipt-server.yml (xymon_port)" when: - main_ipv4_exists.stat.exists - xymon_port_ipv4_present is changed notify: - Restart IPv4 Firewall - name: Check if String 'xymon_port=..' is present shell: grep -q -E "^xymon_port=" /etc/ipt-firewall/main_ipv6.conf register: xymon_port_ipv6_present when: main_ipv4_exists.stat.exists failed_when: "xymon_port_ipv6_present.rc > 1" changed_when: "xymon_port_ipv6_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (xymon_port) blockinfile: path: /etc/ipt-firewall/main_ipv6.conf insertafter: '^#?\s*local_xymon_client' block: | # - Port used by local Xymon Services # - # - !! Only one port is possible !! # - xymon_port="$standard_xymon_port" marker: "# Marker set by modify-ipt-server.yml (xymon_port)" when: - main_ipv6_exists.stat.exists - xymon_port_ipv6_present is changed notify: - Restart IPv6 Firewall # --- # mumble_ports # --- - name: Check if String 'mumble_ports=..' is present shell: grep -q -E "^mumble_ports=" /etc/ipt-firewall/main_ipv4.conf register: mumble_ports_ipv4_present when: main_ipv4_exists.stat.exists failed_when: "mumble_ports_ipv4_present.rc > 1" changed_when: "mumble_ports_ipv4_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (mumble_ports) blockinfile: path: /etc/ipt-firewall/main_ipv4.conf insertafter: '^#?\s*forward_mumble_server_ips' block: | # - Ports used by local Mumble Services # - # - comma separated list # - mumble_ports="$standard_mumble_port" marker: "# Marker set by modify-ipt-server.yml (mumble_ports)" when: - main_ipv4_exists.stat.exists - mumble_ports_ipv4_present is changed notify: - Restart IPv4 Firewall - name: Check if String 'mumble_ports=..' is present shell: grep -q -E "^mumble_ports=" /etc/ipt-firewall/main_ipv6.conf register: mumble_ports_ipv6_present when: main_ipv4_exists.stat.exists failed_when: "mumble_ports_ipv6_present.rc > 1" changed_when: "mumble_ports_ipv6_present.rc > 0" - name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (mumble_ports) blockinfile: path: /etc/ipt-firewall/main_ipv6.conf insertafter: '^#?\s*forward_mumble_server_ips' block: | # - Ports used by local Mumble Services # - # - comma separated list # - mumble_ports="$standard_mumble_port" marker: "# Marker set by modify-ipt-server.yml (mumble_ports)" when: - main_ipv6_exists.stat.exists - mumble_ports_ipv6_present is changed notify: - Restart IPv6 Firewall # --- # Remove Marker set by blockinfile # --- - name: Remove marker IPv4 replace : path: /etc/ipt-firewall/main_ipv4.conf regexp: "^# Marker set by modify-ipt-server.yml.*$" replace: "" register: marker_ipv4_removed #failed_when: "marker_ipv4_removed.rc > 1" #changed_when: "marker_ipv4_removed.rc < 1" when: - main_ipv4_exists.stat.exists - name: Remove marker IPv6 replace : path: /etc/ipt-firewall/main_ipv6.conf regexp: "^# Marker set by modify-ipt-server.yml.*$" replace: "" register: marker_ipv6_removed #failed_when: "marker_ipv6_removed.rc > 1" #changed_when: "marker_ipv6_removed.rc < 1" when: - main_ipv6_exists.stat.exists # === # Update/Modify firewall # === # --- # Host specific configuration files # --- # /etc/ipt-firewall/interfaces_ipv[4|6].conf # - name: Place new configuration file '/etc/ipt-firewall/interfaces_ipv4.conf' command: cp {{ git_firewall_repository.dest }}/conf/interfaces_ipv4.conf.sample /etc/ipt-firewall/interfaces_ipv4.conf when: not interfaces_ipv4_exists.stat.exists register: new_interfaces_ipv4 - name: Configure interfaces_ipv4.conf 1/2 lineinfile: path: /etc/ipt-firewall/interfaces_ipv4.conf regexp: '^ext_if_{{ idx + 1 }}=' line: 'ext_if_{{ idx + 1 }}="{{ item.device }}"' loop: "{{ ansible_netdev }}" loop_control: label: "{{ item.device }}" index_var: idx when: - not interfaces_ipv4_exists.stat.exists - new_interfaces_ipv4 is changed - item.ipv4.address is defined and item.ipv4.address|length > 0 - name: Configure interfaces_ipv4.conf 2/2 lineinfile: path: /etc/ipt-firewall/interfaces_ipv4.conf regexp: '^ext_{{ idx + 1 }}_ip=' line: 'ext_{{ idx + 1 }}_ip="{{ item.ipv4.address }}"' loop: "{{ ansible_netdev }}" loop_control: label: "{{ item.device }}" index_var: idx when: - not interfaces_ipv4_exists.stat.exists - new_interfaces_ipv4 is changed - item.ipv4.address is defined and item.ipv4.address|length > 0 - name: Place new configuration file '/etc/ipt-firewall/interfaces_ipv6.conf' command: cp {{ git_firewall_repository.dest }}/conf/interfaces_ipv6.conf.sample /etc/ipt-firewall/interfaces_ipv6.conf when: not interfaces_ipv6_exists.stat.exists register: new_interfaces_ipv6 - name: Configure interfaces_ipv6.conf 1/2 lineinfile: path: /etc/ipt-firewall/interfaces_ipv6.conf regexp: '^ext_if_{{ idx + 1 }}=' line: 'ext_if_{{ idx + 1 }}="{{ item.device }}"' loop: "{{ ansible_netdev }}" loop_control: label: "{{ item.device }}" index_var: idx when: - not interfaces_ipv6_exists.stat.exists - new_interfaces_ipv6 is changed - item.ipv6.0.address is defined and item.ipv6.0.address|length > 0 - name: Configure interfaces_ipv4.conf 2/2 lineinfile: path: /etc/ipt-firewall/interfaces_ipv6.conf regexp: '^ext_{{ idx + 1 }}_ip=' #line: 'ext_{{ idx + 1 }}_ip="{{ item.ipv6.0.address }} {{ item.ipv6.1.address | default('') }}"' line: "ext_{{ idx + 1 }}_ip=\"{{ item.ipv6.0.address }}{{ (item.ipv6.1.address is match 'f.*') | ternary('', ' ' + item.ipv6.1.address) }}\"" loop: "{{ ansible_netdev }}" loop_control: label: "{{ item.device }}" index_var: idx when: - not interfaces_ipv6_exists.stat.exists - new_interfaces_ipv6 is changed - item.ipv6.0.address is defined and item.ipv6.0.address|length > 0 # /etc/ipt-firewall/ban_ipv[4|6].list # - name: Place new configuration file '/etc/ipt-firewall/ban_ipv4.list' command: cp {{ git_firewall_repository.dest }}/conf/ban_ipv4.list.sample /etc/ipt-firewall/ban_ipv4.list when: not ban_ipv4_exists.stat.exists - name: Place new configuration file '/etc/ipt-firewall/ban_ipv6.list' command: cp {{ git_firewall_repository.dest }}/conf/ban_ipv6.list.sample /etc/ipt-firewall/ban_ipv6.list when: not ban_ipv6_exists.stat.exists # /etc/ipt-firewall/main_ipv[4|6].conf # - name: Place new configuration file '/etc/ipt-firewall/main_ipv4.conf' command: cp {{ git_firewall_repository.dest }}/conf/main_ipv4.conf.sample /etc/ipt-firewall/main_ipv4.conf when: not main_ipv4_exists.stat.exists register: cp_main_ipv4 - name: Place new configuration file '/etc/ipt-firewall/main_ipv6.conf' command: cp {{ git_firewall_repository.dest }}/conf/main_ipv6.conf.sample /etc/ipt-firewall/main_ipv6.conf when: not main_ipv6_exists.stat.exists register: cp_main_ipv6 # Configure main_ipv4.conf # - name: Configure main_ipv4.conf (dns_server_ips) lineinfile: path: /etc/ipt-firewall/main_ipv4.conf regexp: '^\s*dns_server_ips' line: dns_server_ips="$ext_ips" state: present when: - "groups['dns_server']|string is search(inventory_hostname)" - not main_ipv4_exists.stat.exists - cp_main_ipv4 is changed - name: Configure main_ipv4.conf (ssh_server_ips) lineinfile: path: /etc/ipt-firewall/main_ipv4.conf regexp: '^\s*ssh_server_ips' line: ssh_server_ips="$ext_ips" state: present when: - not main_ipv4_exists.stat.exists - cp_main_ipv4 is changed - name: Configure main_ipv4.conf (http_server_ips) lineinfile: path: /etc/ipt-firewall/main_ipv4.conf regexp: '^\s*http_server_ips=' line: http_server_ips="$ext_1_ip" state: present when: - "groups['apache2_webserver']|string is search(inventory_hostname) or groups['nginx_webserver']|string is search(inventory_hostname)" - not main_ipv4_exists.stat.exists - cp_main_ipv4 is changed - name: Configure main_ipv4.conf (mail_client_ips) lineinfile: path: /etc/ipt-firewall/main_ipv4.conf regexp: '^\s*mail_client_ips=' line: mail_client_ips="$ext_1_ip" state: present when: - "groups['apache2_webserver']|string is search(inventory_hostname) or groups['nginx_webserver']|string is search(inventory_hostname)" - not main_ipv4_exists.stat.exists - cp_main_ipv4 is changed - name: Configure main_ipv4.conf (smtpd_ips) lineinfile: path: /etc/ipt-firewall/main_ipv4.conf regexp: '^\s*smtpd_ips=' line: smtpd_ips="$ext_1_ip" state: present when: - "groups['mail_server']|string is search(inventory_hostname)" - not main_ipv4_exists.stat.exists - cp_main_ipv4 is changed - name: Configure main_ipv4.conf (mail_server_ips) lineinfile: path: /etc/ipt-firewall/main_ipv4.conf regexp: '^\s*mail_server_ips=' line: mail_server_ips="$ext_1_ip" state: present when: - "groups['mail_server']|string is search(inventory_hostname)" - not main_ipv4_exists.stat.exists - cp_main_ipv4 is changed - name: Configure main_ipv4.conf (ftp_server_ips) lineinfile: path: /etc/ipt-firewall/main_ipv4.conf regexp: '^\s*ftp_server_ips=' line: ftp_server_ips="$ext_1_ip" state: present when: - "groups['ftp_server']|string is search(inventory_hostname)" - not main_ipv4_exists.stat.exists - cp_main_ipv4 is changed - name: Configure main_ipv4.conf (mumble_server_ips) lineinfile: path: /etc/ipt-firewall/main_ipv4.conf regexp: '^\s*mumble_server_ips=' line: mumble_server_ips="$ext_1_ip" state: present when: - "groups['mumble_server']|string is search(inventory_hostname)" - not main_ipv4_exists.stat.exists - cp_main_ipv4 is changed # Configure main_ipv6.conf # - name: Configure main_ipv6.conf (dns_server_ips) lineinfile: path: /etc/ipt-firewall/main_ipv6.conf regexp: '^\s*dns_server_ips' line: dns_server_ips="$ext_ips" state: present when: - "groups['dns_server']|string is search(inventory_hostname)" - not main_ipv6_exists.stat.exists - cp_main_ipv6 is changed - name: Configure main_ipv6.conf (ssh_server_ips) lineinfile: path: /etc/ipt-firewall/main_ipv6.conf regexp: '^\s*ssh_server_ips' line: ssh_server_ips="$ext_ips" state: present when: - not main_ipv6_exists.stat.exists - cp_main_ipv6 is changed - name: Configure main_ipv6.conf (http_server_ips) lineinfile: path: /etc/ipt-firewall/main_ipv6.conf regexp: '^\s*http_server_ips=' line: http_server_ips="$ext_1_ip" state: present when: - "groups['apache2_webserver']|string is search(inventory_hostname) or groups['nginx_webserver']|string is search(inventory_hostname)" - not main_ipv6_exists.stat.exists - cp_main_ipv6 is changed - name: Configure main_ipv6.conf (mail_client_ips) lineinfile: path: /etc/ipt-firewall/main_ipv6.conf regexp: '^\s*mail_client_ips=' line: mail_client_ips="$ext_1_ip" state: present when: - "groups['apache2_webserver']|string is search(inventory_hostname) or groups['nginx_webserver']|string is search(inventory_hostname)" - not main_ipv6_exists.stat.exists - cp_main_ipv6 is changed - name: Configure main_ipv6.conf (smtpd_ips) lineinfile: path: /etc/ipt-firewall/main_ipv6.conf regexp: '^\s*smtpd_ips=' line: smtpd_ips="$ext_1_ip" state: present when: - "groups['mail_server']|string is search(inventory_hostname)" - not main_ipv6_exists.stat.exists - cp_main_ipv6 is changed - name: Configure main_ipv6.conf (mail_server_ips) lineinfile: path: /etc/ipt-firewall/main_ipv6.conf regexp: '^\s*mail_server_ips=' line: mail_server_ips="$ext_1_ip" state: present when: - "groups['mail_server']|string is search(inventory_hostname)" - not main_ipv6_exists.stat.exists - cp_main_ipv6 is changed - name: Configure main_ipv6.conf (ftp_server_ips) lineinfile: path: /etc/ipt-firewall/main_ipv6.conf regexp: '^\s*ftp_server_ips=' line: ftp_server_ips="$ext_1_ip" state: present when: - "groups['ftp_server']|string is search(inventory_hostname)" - not main_ipv6_exists.stat.exists - cp_main_ipv6 is changed - name: Configure main_ipv6.conf (mumble_server_ips) lineinfile: path: /etc/ipt-firewall/main_ipv6.conf regexp: '^\s*mumble_server_ips=' line: mumble_server_ips="$ext_1_ip" state: present when: - "groups['mumble_server']|string is search(inventory_hostname)" - not main_ipv6_exists.stat.exists - cp_main_ipv6 is changed # --- # Host independet configuration files # --- - name: Check if common configuration files are latest shell: 'diff {{ git_firewall_repository.dest }}/conf/{{ item }} /etc/ipt-firewall/{{ item }} > /dev/null 2>&1' changed_when: "diff_output.rc > 0" # diff_output.rc # 0 -> unchanged # 1 -> changed # 2 -> not present failed_when: "diff_output.rc > 2" when: git_firewall_repository is defined and git_firewall_repository > 0 loop: - include_functions.conf - load_modules_ipv4.conf - load_modules_ipv6.conf - logging_ipv4.conf - logging_ipv6.conf - default_ports.conf - post_decalrations.conf register: diff_output - name: Ensure common configuration files are latest command: cp {{ git_firewall_repository.dest }}/conf/{{ item }} /etc/ipt-firewall/{{ item }} loop: - include_functions.conf - load_modules_ipv4.conf - load_modules_ipv6.conf - logging_ipv4.conf - logging_ipv6.conf - default_ports.conf - post_decalrations.conf when: - git_firewall_repository is defined and git_firewall_repository > 0 - diff_output.changed notify: - Restart IPv4 Firewall - Restart IPv6 Firewall # --- # Firewall scripts # --- - name: Check if firewall scripts are latest shell: 'diff {{ git_firewall_repository.dest }}/{{ item }} /usr/local/sbin/{{ item }} > /dev/null 2>&1' changed_when: "diff_script_output.rc > 0" # diff_output.rc # 0 -> unchanged # 1 -> changed # 2 -> not present failed_when: "diff_script_output.rc > 2" when: git_firewall_repository is defined and git_firewall_repository > 0 loop: - ipt-firewall-server - ip6t-firewall-server register: diff_script_output - name: Ensure firewall scripts are latest command: cp {{ git_firewall_repository.dest }}/{{ item }} /usr/local/sbin/{{ item }} loop: - ipt-firewall-server - ip6t-firewall-server when: - git_firewall_repository is defined and git_firewall_repository > 0 - diff_script_output.changed notify: - Restart IPv4 Firewall - Restart IPv6 Firewall # --- # Install systemd service files ip[6]t-firewall.service # --- - name: Configure firewall systemd service files template: src: etc/systemd/system/{{ item }}-firewall.service.j2 dest: /etc/systemd/system/{{ item }}-firewall.service register: systemd_service_files_installed with_items: - ipt - ip6t - name: Enable firewall services IPv4 systemd: name: ipt-firewall state: stopped enabled: yes daemon_reload: yes when: systemd_service_files_installed is changed register: firewall_service_started - name: Enable firewall services IPv6 systemd: name: ip6t-firewall state: stopped enabled: yes daemon_reload: yes when: systemd_service_files_installed is changed register: firewall_service_started - meta: end_host when: firewall_service_started is changed # --- # Delete unused files # --- - name: Delete file /etc/ipt-firewall/ports.conf file: path: /etc/ipt-firewall/ports.conf state: absent when: systemd_service_files_installed is changed # === # Handlers used by this playbook # === handlers: - name: Restart ulogd service: name: ulogd state: restarted - name: Restart IPv4 Firewall service: name: ipt-firewall state: restarted when: - interfaces_ipv4_exists.stat.exists - main_ipv4_exists.stat.exists - name: Restart IPv6 Firewall service: name: ip6t-firewall state: restarted when: - interfaces_ipv6_exists.stat.exists - main_ipv6_exists.stat.exists