ansible/oopen-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
1c1a5fce41
oopen-server/roles/modify-ipt-gateway-ro/tasks/main.yml

400 lines
12 KiB
YAML
Raw Blame History

---
# ---
# Remount Filesystem writable
# ---
- name: Remount "/ro/" writable
shell: remountrw
# ---
# Install/Uodate git firewall repository
# ---
- name: Install/update firewall repository
git:
repo: '{{ git_firewall_repository.repo }}'
dest: '{{ git_firewall_repository.dest }}'
when: git_firewall_repository is defined and git_firewall_repository|length > 0
# ---
# Some Checks
# ---
- name: Check if file '/ro/etc/ipt-firewall/main_ipv4.conf' exists
stat:
path: /ro/etc/ipt-firewall/main_ipv4.conf
register: main_ipv4_exists
- name: Check if file '/ro/etc/ipt-firewall/main_ipv6.conf' exists
stat:
path: /ro/etc/ipt-firewall/main_ipv6.conf
register: main_ipv6_exists
- name: addjust line 'jitsi_tcp_ports' (IPv4)
lineinfile:
path: /ro/etc/ipt-firewall/main_ipv4.conf
regexp: '^jitsi_tcp_ports='
line: 'jitsi_tcp_ports="$standard_jitsi_tcp_ports"'
- name: addjust line 'jitsi_tcp_ports' (IPv6)
lineinfile:
path: /ro/etc/ipt-firewall/main_ipv6.conf
regexp: '^jitsi_tcp_ports='
line: 'jitsi_tcp_ports="$standard_jitsi_tcp_ports"'
when:
- main_ipv6_exists.stat.exists
- name: addjust line 'jitsi_udp_ports' (IPv4)
lineinfile:
path: /ro/etc/ipt-firewall/main_ipv4.conf
regexp: '^jitsi_udp_ports='
line: 'jitsi_udp_ports="$standard_jitsi_udp_port_range"'
- name: addjust line 'jitsi_udp_ports' (IPv6)
lineinfile:
path: /ro/etc/ipt-firewall/main_ipv6.conf
regexp: '^jitsi_udp_ports='
line: 'jitsi_udp_ports="$standard_jitsi_udp_port_range"'
when:
- main_ipv6_exists.stat.exists
# ---
# allow_jitsi_video_conference_out
# ---
- name: Check if String 'allow_jitsi_video_conference_out..' (IPv4) is present
shell: grep -q -E "^allow_jitsi_video_conference_out=" /ro/etc/ipt-firewall/main_ipv4.conf
register: jitsi_video_conference_out_ipv4_present
when: main_ipv4_exists.stat.exists
failed_when: "jitsi_video_conference_out_ipv4_present.rc > 1"
changed_when: "jitsi_video_conference_out_ipv4_present.rc > 0"
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (jitsi)
lineinfile:
dest: /ro/etc/ipt-firewall/main_ipv4.conf
state: present
regexp: '^allow_jitsi_video_conference_out'
line: 'allow_jitsi_video_conference_out=true'
insertafter: '^#?\s*allow_mumble_request_out'
when:
- main_ipv4_exists.stat.exists
- jitsi_video_conference_out_ipv4_present is changed
- name: Check if String 'allow_jitsi_video_conference_out..' (IPv6) is present
shell: grep -q -E "^allow_jitsi_video_conference_out=" /ro/etc/ipt-firewall/main_ipv6.conf
register: jitsi_video_conference_out_ipv6_present
when: main_ipv6_exists.stat.exists
failed_when: "jitsi_video_conference_out_ipv6_present.rc > 1"
changed_when: "jitsi_video_conference_out_ipv6_present.rc > 0"
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (jitsi)
lineinfile:
dest: /ro/etc/ipt-firewall/main_ipv6.conf
state: present
regexp: '^allow_jitsi_video_conference_out'
line: 'allow_jitsi_video_conference_out=true'
insertafter: '^#?\s*allow_mumble_request_out'
when:
- main_ipv6_exists.stat.exists
- jitsi_video_conference_out_ipv6_present is changed
# ---
# allow_nc_talk_out
# ---
- name: Check if String 'allow_nc_talk_out..' (IPv4) is present
shell: grep -q -E "^allow_nc_talk_out=" /ro/etc/ipt-firewall/main_ipv4.conf
register: nc_talk_out_ipv4_present
when: main_ipv4_exists.stat.exists
failed_when: "nc_talk_out_ipv4_present.rc > 1"
changed_when: "nc_talk_out_ipv4_present.rc > 0"
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (jitsi)
lineinfile:
dest: /ro/etc/ipt-firewall/main_ipv4.conf
state: present
regexp: '^allow_nc_talk_out'
line: 'allow_nc_talk_out=true'
insertafter: '^#?\s*allow_jitsi_video_conference_out'
when:
- main_ipv4_exists.stat.exists
- nc_talk_out_ipv4_present is changed
- name: Check if String 'allow_nc_talk_out..' (IPv6) is present
shell: grep -q -E "^allow_nc_talk_out=" /ro/etc/ipt-firewall/main_ipv6.conf
register: nc_talk_out_ipv6_present
when: main_ipv6_exists.stat.exists
failed_when: "nc_talk_out_ipv6_present.rc > 1"
changed_when: "nc_talk_out_ipv6_present.rc > 0"
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (jitsi)
lineinfile:
dest: /ro/etc/ipt-firewall/main_ipv6.conf
state: present
regexp: '^allow_nc_talk_out'
line: 'allow_nc_talk_out=true'
insertafter: '^#?\s*allow_jitsi_video_conference_out'
when:
- main_ipv6_exists.stat.exists
- nc_talk_out_ipv6_present is changed
# ---
# jitsi video conference service
# ---
- name: Check if String 'jitsi_tcp_ports=..' (IPv4) is present
shell: grep -q -E "^jitsi_tcp_ports=" /ro/etc/ipt-firewall/main_ipv4.conf
register: jitsi_service_ipv4_present
when: main_ipv4_exists.stat.exists
failed_when: "jitsi_service_ipv4_present.rc > 1"
changed_when: "jitsi_service_ipv4_present.rc > 0"
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (jitsi service)
blockinfile:
path: /ro/etc/ipt-firewall/main_ipv4.conf
insertafter: '^#?\s*mumble_ports'
block: |
# ======
# - Jitsi Video Conference Service
# ======
# - Jitsi Video Conference Service Gateway
# -
# - NOT YET IMPLEMENTED
# -
local_jitsi_video_conference_service=false
# - Jitsi Video Conference Service Ports
# -
# - TCP 80: Webinterface.
# - TCP 443: Webinterface (SSL)
# -
# - UDP 10000-20000: Virtual Media for Remote Console
# -
jitsi_tcp_ports="$standard_jitsi_tcp_ports"
jitsi_udp_ports="$standard_jitsi_udp_port_range"
marker: "# Marker set by modify-ipt-gateway.yml (jitsi service)"
when:
- main_ipv4_exists.stat.exists
- jitsi_service_ipv4_present is changed
- name: Check if String 'jitsi_tcp_ports=..' (IPv6) is present
shell: grep -q -E "^jitsi_tcp_ports=" /ro/etc/ipt-firewall/main_ipv6.conf
register: jitsi_service_ipv6_present
when: main_ipv6_exists.stat.exists
failed_when: "jitsi_service_ipv6_present.rc > 1"
changed_when: "jitsi_service_ipv6_present.rc > 0"
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (jitsi service)
blockinfile:
path: /ro/etc/ipt-firewall/main_ipv6.conf
insertafter: '^#?\s*mumble_ports'
block: |
# ======
# - Jitsi Video Conference Service
# ======
# - Jitsi Video Conference Service Gateway
# -
# - NOT YET IMPLEMENTED
# -
local_jitsi_video_conference_service=false
# - Jitsi Video Conference Service Ports
# -
# - TCP 80: Webinterface.
# - TCP 443: Webinterface (SSL)
# -
# - UDP 10000-20000: Virtual Media for Remote Console
# -
jitsi_tcp_ports="$standard_jitsi_tcp_ports"
jitsi_udp_ports="$standard_jitsi_udp_port_range"
marker: "# Marker set by modify-ipt-gateway.yml (jitsi service)"
when:
- main_ipv6_exists.stat.exists
- jitsi_service_ipv6_present is changed
# ---
# TURN Server (Stun Server) (for Nextcloud 'talk' app)
# ---
- name: Check if String 'nc_turn_ports=..' (IPv4) is present
shell: grep -q -E "^nc_turn_ports=" /ro/etc/ipt-firewall/main_ipv4.conf
register: nc_turn_service_ipv4_present
when: main_ipv4_exists.stat.exists
failed_when: "nc_turn_service_ipv4_present.rc > 1"
changed_when: "nc_turn_service_ipv4_present.rc > 0"
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv4.conf' (nc's turn service)
blockinfile:
path: /ro/etc/ipt-firewall/main_ipv4.conf
insertafter: '^#?\s*jitsi_udp_ports'
block: |
# ======
# - TURN Server (Stun Server) (for Nextcloud 'talk' app)
# ======
# - TURN Server (Stun Server) (for Nextcloud 'talk' app)
# -
# - NOT YET IMPLEMENTED
# -
local_nc_turn_service=""
# - Ports used by local TURN Server (Stun Server)
# -
# - comma separated list
# -
nc_turn_ports="$standard_turn_service_ports"
nc_turn_udp_ports="$standard_turn_service_udp_ports"
marker: "# Marker set by modify-ipt-gateway.yml (nc's turn service)"
when:
- main_ipv4_exists.stat.exists
- nc_turn_service_ipv4_present is changed
- name: Check if String 'nc_turn_ports=..' (IPv6) is present
shell: grep -q -E "^nc_turn_ports=" /ro/etc/ipt-firewall/main_ipv6.conf
register: nc_turn_service_ipv6_present
when: main_ipv6_exists.stat.exists
failed_when: "nc_turn_service_ipv6_present.rc > 1"
changed_when: "nc_turn_service_ipv6_present.rc > 0"
- name: Adjust file '/ro/etc/ipt-firewall/main_ipv6.conf' (jitsi service)
blockinfile:
path: /ro/etc/ipt-firewall/main_ipv6.conf
insertafter: '^#?\s*jitsi_udp_ports'
block: |
# ======
# - TURN Server (Stun Server) (for Nextcloud 'talk' app)
# ======
# - TURN Server (Stun Server) (for Nextcloud 'talk' app)
# -
# - NOT YET IMPLEMENTED
# -
local_nc_turn_service=""
# - Ports used by local TURN Server (Stun Server)
# -
# - comma separated list
# -
nc_turn_ports="$standard_turn_service_ports"
nc_turn_udp_ports="$standard_turn_service_udp_ports"
marker: "# Marker set by modify-ipt-gateway.yml (jitsi service)"
when:
- main_ipv6_exists.stat.exists
- nc_turn_service_ipv6_present is changed
# ---
# Remove Marker set by blockinfile
# ---
- name: Remove marker IPv4
replace :
path: /ro/etc/ipt-firewall/main_ipv4.conf
regexp: "^# Marker set by modify-ipt-gateway.yml.*$"
replace: ""
register: marker_ipv4_removed
#failed_when: "marker_ipv4_removed.rc > 1"
#changed_when: "marker_ipv4_removed.rc < 1"
when:
- main_ipv4_exists.stat.exists
- name: Remove marker IPv6
replace :
path: /ro/etc/ipt-firewall/main_ipv6.conf
regexp: "^# Marker set by modify-ipt-gateway.yml.*$"
replace: ""
register: marker_ipv6_removed
#failed_when: "marker_ipv6_removed.rc > 1"
#changed_when: "marker_ipv6_removed.rc < 1"
when:
- main_ipv6_exists.stat.exists
# ---
# Confiuration Files
# ---
- name: Check if configuration files are latest
shell: 'diff {{ git_firewall_repository.dest }}/conf/{{ item }} /ro/etc/ipt-firewall/{{ item }} > /dev/null 2>&1'
changed_when: "diff_script_output.rc > 0"
# diff_output.rc
# 0 -> unchanged
# 1 -> changed
# 2 -> not present
failed_when: "diff_script_output.rc > 2"
when: git_firewall_repository is defined and git_firewall_repository > 0
loop:
- default_ports.conf
- include_functions.conf
- load_modules_ipv4.conf
- load_modules_ipv6.conf
- logging_ipv4.conf
- logging_ipv6.conf
- post_decalrations.conf
register: diff_script_output
- name: Ensure configuration files are latest
command: cp {{ git_firewall_repository.dest }}/conf/{{ item }} /ro/etc/ipt-firewall/{{ item }}
loop:
- default_ports.conf
- include_functions.conf
- load_modules_ipv4.conf
- load_modules_ipv6.conf
- logging_ipv4.conf
- logging_ipv6.conf
- post_decalrations.conf
when:
- git_firewall_repository is defined and git_firewall_repository > 0
- diff_script_output.changed
notify:
- Restart IPv4 Firewall
- Restart IPv6 Firewall
# ---
# Firewall scripts
# ---
- name: Check if firewall scripts are latest
shell: 'diff {{ git_firewall_repository.dest }}/{{ item }} /ro/usr/local/sbin/{{ item }} > /dev/null 2>&1'
changed_when: "diff_script_output.rc > 0"
# diff_output.rc
# 0 -> unchanged
# 1 -> changed
# 2 -> not present
failed_when: "diff_script_output.rc > 2"
when: git_firewall_repository is defined and git_firewall_repository > 0
loop:
- ipt-firewall-gateway
- ip6t-firewall-gateway
register: diff_script_output
- name: Ensure firewall scripts are latest
command: cp {{ git_firewall_repository.dest }}/{{ item }} /ro/usr/local/sbin/{{ item }}
loop:
- ipt-firewall-gateway
- ip6t-firewall-gateway
when:
- git_firewall_repository is defined and git_firewall_repository > 0
- diff_script_output.changed
notify:
- Restart IPv4 Firewall
- Restart IPv6 Firewall
# ---
# Remount Filesystem readonly
# ---
- name: Remount "/ro/" readonly
shell: remountro
register: remountro_cmd
failed_when: remountro_cmd.rc != 0 and remountro_cmd.rc != 32
Reference in New Issue View Git Blame Copy Permalink