515 lines
16 KiB
YAML
515 lines
16 KiB
YAML
---
|
|
|
|
# ---
|
|
# Install/Uodate git firewall repository
|
|
# ---
|
|
|
|
- name: Install/update firewall repository
|
|
git:
|
|
repo: '{{ git_firewall_repository.repo }}'
|
|
dest: '{{ git_firewall_repository.dest }}'
|
|
when: git_firewall_repository is defined and git_firewall_repository|length > 0
|
|
|
|
|
|
# ---
|
|
# Some Checks
|
|
# ---
|
|
|
|
- name: Check if file '/etc/ipt-firewall/main_ipv4.conf' exists
|
|
stat:
|
|
path: /etc/ipt-firewall/main_ipv4.conf
|
|
register: main_ipv4_exists
|
|
notify:
|
|
- Restart IPv4 Firewall
|
|
|
|
- name: Check if file '/etc/ipt-firewall/main_ipv6.conf' exists
|
|
stat:
|
|
path: /etc/ipt-firewall/main_ipv6.conf
|
|
register: main_ipv6_exists
|
|
notify:
|
|
- Restart IPv6 Firewall
|
|
|
|
- name: addjust line 'jitsi_tcp_ports' (IPv4)
|
|
lineinfile:
|
|
path: /etc/ipt-firewall/main_ipv4.conf
|
|
regexp: '^jitsi_tcp_ports='
|
|
line: 'jitsi_tcp_ports="$standard_jitsi_tcp_ports"'
|
|
notify:
|
|
- Restart IPv4 Firewall
|
|
|
|
- name: addjust line 'jitsi_tcp_ports' (IPv6)
|
|
lineinfile:
|
|
path: /etc/ipt-firewall/main_ipv6.conf
|
|
regexp: '^jitsi_tcp_ports='
|
|
line: 'jitsi_tcp_ports="$standard_jitsi_tcp_ports"'
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
notify:
|
|
- Restart IPv6 Firewall
|
|
|
|
- name: addjust line 'jitsi_udp_ports' (IPv4)
|
|
lineinfile:
|
|
path: /etc/ipt-firewall/main_ipv4.conf
|
|
regexp: '^jitsi_udp_ports='
|
|
line: 'jitsi_udp_ports="$standard_jitsi_udp_port_range"'
|
|
notify:
|
|
- Restart IPv4 Firewall
|
|
|
|
- name: addjust line 'jitsi_udp_ports' (IPv6)
|
|
lineinfile:
|
|
path: /etc/ipt-firewall/main_ipv6.conf
|
|
regexp: '^jitsi_udp_ports='
|
|
line: 'jitsi_udp_ports="$standard_jitsi_udp_port_range"'
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
notify:
|
|
- Restart IPv6 Firewall
|
|
|
|
# ---
|
|
# allow_jitsi_video_conference_out
|
|
# ---
|
|
|
|
- name: Check if String 'allow_jitsi_video_conference_out..' (IPv4) is present
|
|
shell: grep -q -E "^allow_jitsi_video_conference_out=" /etc/ipt-firewall/main_ipv4.conf
|
|
register: jitsi_video_conference_out_ipv4_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "jitsi_video_conference_out_ipv4_present.rc > 1"
|
|
changed_when: "jitsi_video_conference_out_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (jitsi)
|
|
lineinfile:
|
|
dest: /etc/ipt-firewall/main_ipv4.conf
|
|
state: present
|
|
regexp: '^allow_jitsi_video_conference_out'
|
|
line: 'allow_jitsi_video_conference_out=true'
|
|
insertafter: '^#?\s*allow_mumble_request_out'
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
- jitsi_video_conference_out_ipv4_present is changed
|
|
|
|
- name: Check if String 'allow_jitsi_video_conference_out..' (IPv6) is present
|
|
shell: grep -q -E "^allow_jitsi_video_conference_out=" /etc/ipt-firewall/main_ipv6.conf
|
|
register: jitsi_video_conference_out_ipv6_present
|
|
when: main_ipv6_exists.stat.exists
|
|
failed_when: "jitsi_video_conference_out_ipv6_present.rc > 1"
|
|
changed_when: "jitsi_video_conference_out_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (jitsi)
|
|
lineinfile:
|
|
dest: /etc/ipt-firewall/main_ipv6.conf
|
|
state: present
|
|
regexp: '^allow_jitsi_video_conference_out'
|
|
line: 'allow_jitsi_video_conference_out=true'
|
|
insertafter: '^#?\s*allow_mumble_request_out'
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
- jitsi_video_conference_out_ipv6_present is changed
|
|
notify:
|
|
- Restart IPv6 Firewall
|
|
|
|
# ---
|
|
# allow_nc_talk_out
|
|
# ---
|
|
|
|
- name: Check if String 'allow_nc_talk_out..' (IPv4) is present
|
|
shell: grep -q -E "^allow_nc_talk_out=" /etc/ipt-firewall/main_ipv4.conf
|
|
register: nc_talk_out_ipv4_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "nc_talk_out_ipv4_present.rc > 1"
|
|
changed_when: "nc_talk_out_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (jitsi)
|
|
lineinfile:
|
|
dest: /etc/ipt-firewall/main_ipv4.conf
|
|
state: present
|
|
regexp: '^allow_nc_talk_out'
|
|
line: 'allow_nc_talk_out=true'
|
|
insertafter: '^#?\s*allow_jitsi_video_conference_out'
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
- nc_talk_out_ipv4_present is changed
|
|
|
|
- name: Check if String 'allow_nc_talk_out..' (IPv6) is present
|
|
shell: grep -q -E "^allow_nc_talk_out=" /etc/ipt-firewall/main_ipv6.conf
|
|
register: nc_talk_out_ipv6_present
|
|
when: main_ipv6_exists.stat.exists
|
|
failed_when: "nc_talk_out_ipv6_present.rc > 1"
|
|
changed_when: "nc_talk_out_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (jitsi)
|
|
lineinfile:
|
|
dest: /etc/ipt-firewall/main_ipv6.conf
|
|
state: present
|
|
regexp: '^allow_nc_talk_out'
|
|
line: 'allow_nc_talk_out=true'
|
|
insertafter: '^#?\s*allow_jitsi_video_conference_out'
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
- nc_talk_out_ipv6_present is changed
|
|
|
|
# ---
|
|
# allow_bigbluebutton_video_conference_out
|
|
# ---
|
|
|
|
- name: Check if String 'allow_bigbluebutton_video_conference_out..' (IPv4) is present
|
|
shell: grep -q -E "^allow_bigbluebutton_video_conference_out=" /etc/ipt-firewall/main_ipv4.conf
|
|
register: bigbluebutton_video_conference_out_ipv4_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "bigbluebutton_video_conference_out_ipv4_present.rc > 1"
|
|
changed_when: "bigbluebutton_video_conference_out_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (bigbluebutton)
|
|
lineinfile:
|
|
dest: /etc/ipt-firewall/main_ipv4.conf
|
|
state: present
|
|
regexp: '^allow_bigbluebutton_video_conference_out'
|
|
line: 'allow_bigbluebutton_video_conference_out=true'
|
|
insertafter: '^#?\s*allow_mumble_request_out'
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
- bigbluebutton_video_conference_out_ipv4_present is changed
|
|
|
|
- name: Check if String 'allow_bigbluebutton_video_conference_out..' (IPv6) is present
|
|
shell: grep -q -E "^allow_bigbluebutton_video_conference_out=" /etc/ipt-firewall/main_ipv6.conf
|
|
register: bigbluebutton_video_conference_out_ipv6_present
|
|
when: main_ipv6_exists.stat.exists
|
|
failed_when: "bigbluebutton_video_conference_out_ipv6_present.rc > 1"
|
|
changed_when: "bigbluebutton_video_conference_out_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (bigbluebutton)
|
|
lineinfile:
|
|
dest: /etc/ipt-firewall/main_ipv6.conf
|
|
state: present
|
|
regexp: '^allow_bigbluebutton_video_conference_out'
|
|
line: 'allow_bigbluebutton_video_conference_out=true'
|
|
insertafter: '^#?\s*allow_mumble_request_out'
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
- bigbluebutton_video_conference_out_ipv6_present is changed
|
|
|
|
# ---
|
|
# jitsi video conference service
|
|
# ---
|
|
|
|
- name: Check if String 'jitsi_tcp_ports=..' (IPv4) is present
|
|
shell: grep -q -E "^jitsi_tcp_ports=" /etc/ipt-firewall/main_ipv4.conf
|
|
register: jitsi_service_ipv4_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "jitsi_service_ipv4_present.rc > 1"
|
|
changed_when: "jitsi_service_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (jitsi service)
|
|
blockinfile:
|
|
path: /etc/ipt-firewall/main_ipv4.conf
|
|
insertafter: '^#?\s*mumble_ports'
|
|
block: |
|
|
|
|
# ======
|
|
# - Jitsi Video Conference Service
|
|
# ======
|
|
|
|
# - Jitsi Video Conference Service Gateway
|
|
# -
|
|
# - NOT YET IMPLEMENTED
|
|
# -
|
|
local_jitsi_video_conference_service=false
|
|
|
|
# - Jitsi Video Conference Service Ports
|
|
# -
|
|
# - TCP 80: Webinterface.
|
|
# - TCP 443: Webinterface (SSL)
|
|
# -
|
|
# - UDP 10000-20000: Virtual Media for Remote Console
|
|
# -
|
|
jitsi_tcp_ports="$standard_jitsi_tcp_ports"
|
|
jitsi_udp_ports="$standard_jitsi_udp_port_range"
|
|
marker: "# Marker set by modify-ipt-gateway.yml (jitsi service)"
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
- jitsi_service_ipv4_present is changed
|
|
|
|
- name: Check if String 'jitsi_tcp_ports=..' (IPv6) is present
|
|
shell: grep -q -E "^jitsi_tcp_ports=" /etc/ipt-firewall/main_ipv6.conf
|
|
register: jitsi_service_ipv6_present
|
|
when: main_ipv6_exists.stat.exists
|
|
failed_when: "jitsi_service_ipv6_present.rc > 1"
|
|
changed_when: "jitsi_service_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (jitsi service)
|
|
blockinfile:
|
|
path: /etc/ipt-firewall/main_ipv6.conf
|
|
insertafter: '^#?\s*mumble_ports'
|
|
block: |
|
|
|
|
# ======
|
|
# - Jitsi Video Conference Service
|
|
# ======
|
|
|
|
# - Jitsi Video Conference Service Gateway
|
|
# -
|
|
# - NOT YET IMPLEMENTED
|
|
# -
|
|
local_jitsi_video_conference_service=false
|
|
|
|
# - Jitsi Video Conference Service Ports
|
|
# -
|
|
# - TCP 80: Webinterface.
|
|
# - TCP 443: Webinterface (SSL)
|
|
# -
|
|
# - UDP 10000-20000: Virtual Media for Remote Console
|
|
# -
|
|
jitsi_tcp_ports="$standard_jitsi_tcp_ports"
|
|
jitsi_udp_ports="$standard_jitsi_udp_port_range"
|
|
marker: "# Marker set by modify-ipt-gateway.yml (jitsi service)"
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
- jitsi_service_ipv6_present is changed
|
|
|
|
|
|
# ---
|
|
# TURN Server (Stun Server) (for Nextcloud 'talk' app)
|
|
# ---
|
|
|
|
- name: Check if String 'nc_turn_ports=..' (IPv4) is present
|
|
shell: grep -q -E "^nc_turn_ports=" /etc/ipt-firewall/main_ipv4.conf
|
|
register: nc_turn_service_ipv4_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "nc_turn_service_ipv4_present.rc > 1"
|
|
changed_when: "nc_turn_service_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (nc's turn service)
|
|
blockinfile:
|
|
path: /etc/ipt-firewall/main_ipv4.conf
|
|
insertafter: '^#?\s*jitsi_udp_ports'
|
|
block: |
|
|
|
|
# ======
|
|
# - TURN Server (Stun Server) (for Nextcloud 'talk' app)
|
|
# ======
|
|
|
|
# - TURN Server (Stun Server) (for Nextcloud 'talk' app)
|
|
# -
|
|
# - NOT YET IMPLEMENTED
|
|
# -
|
|
local_nc_turn_service=""
|
|
|
|
# - Ports used by local TURN Server (Stun Server)
|
|
# -
|
|
# - comma separated list
|
|
# -
|
|
nc_turn_ports="$standard_turn_service_ports"
|
|
nc_turn_udp_ports="$standard_turn_service_udp_ports"
|
|
marker: "# Marker set by modify-ipt-gateway.yml (nc's turn service)"
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
- nc_turn_service_ipv4_present is changed
|
|
|
|
- name: Check if String 'nc_turn_ports=..' (IPv6) is present
|
|
shell: grep -q -E "^nc_turn_ports=" /etc/ipt-firewall/main_ipv6.conf
|
|
register: nc_turn_service_ipv6_present
|
|
when: main_ipv6_exists.stat.exists
|
|
failed_when: "nc_turn_service_ipv6_present.rc > 1"
|
|
changed_when: "nc_turn_service_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (jitsi service)
|
|
blockinfile:
|
|
path: /etc/ipt-firewall/main_ipv6.conf
|
|
insertafter: '^#?\s*jitsi_udp_ports'
|
|
block: |
|
|
|
|
# ======
|
|
# - TURN Server (Stun Server) (for Nextcloud 'talk' app)
|
|
# ======
|
|
|
|
# - TURN Server (Stun Server) (for Nextcloud 'talk' app)
|
|
# -
|
|
# - NOT YET IMPLEMENTED
|
|
# -
|
|
local_nc_turn_service=""
|
|
|
|
# - Ports used by local TURN Server (Stun Server)
|
|
# -
|
|
# - comma separated list
|
|
# -
|
|
nc_turn_ports="$standard_turn_service_ports"
|
|
nc_turn_udp_ports="$standard_turn_service_udp_ports"
|
|
marker: "# Marker set by modify-ipt-gateway.yml (jitsi service)"
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
- nc_turn_service_ipv6_present is changed
|
|
|
|
# ---
|
|
# BigBlueButton video conference service
|
|
# ---
|
|
|
|
- name: Check if String 'bigbluebutton_tcp_ports=..' (IPv4) is present
|
|
shell: grep -q -E "^bigbluebutton_tcp_ports=" /etc/ipt-firewall/main_ipv4.conf
|
|
register: bigbluebutton_service_ipv4_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "bigbluebutton_service_ipv4_present.rc > 1"
|
|
changed_when: "bigbluebutton_service_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (bigbluebutton service)
|
|
blockinfile:
|
|
path: /etc/ipt-firewall/main_ipv4.conf
|
|
insertafter: '^#?\s*mumble_ports'
|
|
block: |
|
|
|
|
# ======
|
|
# - BigBlueButton Video Conference Service
|
|
# ======
|
|
|
|
# - BigBlueButton Video Conference Service Gateway
|
|
# -
|
|
# - NOT YET IMPLEMENTED
|
|
# -
|
|
local_bigbluebutton_video_conference_service=false
|
|
|
|
# - BigBlueButton Video Conference Service Ports
|
|
# -
|
|
# - TCP 80: Webinterface.
|
|
# - TCP 443: Webinterface (SSL)
|
|
# -
|
|
# - UDP 16384-32768: FreeSWITCH/HTML5 RTP streams
|
|
# -
|
|
bigbluebutton_tcp_ports="$standard_bigbluebutton_tcp_ports"
|
|
bigbluebutton_udp_ports="$standard_bigbluebutton_udp_port_range"
|
|
marker: "# Marker set by modify-ipt-gateway.yml (bigbluebutton service)"
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
- bigbluebutton_service_ipv4_present is changed
|
|
|
|
- name: Check if String 'bigbluebutton_tcp_ports=..' (IPv6) is present
|
|
shell: grep -q -E "^bigbluebutton_tcp_ports=" /etc/ipt-firewall/main_ipv6.conf
|
|
register: bigbluebutton_service_ipv6_present
|
|
when: main_ipv6_exists.stat.exists
|
|
failed_when: "bigbluebutton_service_ipv6_present.rc > 1"
|
|
changed_when: "bigbluebutton_service_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (bigbluebutton service)
|
|
blockinfile:
|
|
path: /etc/ipt-firewall/main_ipv6.conf
|
|
insertafter: '^#?\s*mumble_ports'
|
|
block: |
|
|
|
|
# ======
|
|
# - BigBlueButton Video Conference Service
|
|
# ======
|
|
|
|
# - BigBlueButton Video Conference Service Gateway
|
|
# -
|
|
# - NOT YET IMPLEMENTED
|
|
# -
|
|
local_bigbluebutton_video_conference_service=false
|
|
|
|
# - BigBlueButton Video Conference Service Ports
|
|
# -
|
|
# - TCP 80: Webinterface.
|
|
# - TCP 443: Webinterface (SSL)
|
|
# -
|
|
# - UDP 16384-32768: FreeSWITCH/HTML5 RTP streams
|
|
# -
|
|
bigbluebutton_tcp_ports="$standard_bigbluebutton_tcp_ports"
|
|
bigbluebutton_udp_ports="$standard_bigbluebutton_udp_port_range"
|
|
marker: "# Marker set by modify-ipt-gateway.yml (bigbluebutton service)"
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
- bigbluebutton_service_ipv6_present is changed
|
|
|
|
|
|
# ---
|
|
# Remove Marker set by blockinfile
|
|
# ---
|
|
|
|
- name: Remove marker IPv4
|
|
replace :
|
|
path: /etc/ipt-firewall/main_ipv4.conf
|
|
regexp: "^# Marker set by modify-ipt-gateway.yml.*$"
|
|
replace: ""
|
|
register: marker_ipv4_removed
|
|
#failed_when: "marker_ipv4_removed.rc > 1"
|
|
#changed_when: "marker_ipv4_removed.rc < 1"
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
|
|
- name: Remove marker IPv6
|
|
replace :
|
|
path: /etc/ipt-firewall/main_ipv6.conf
|
|
regexp: "^# Marker set by modify-ipt-gateway.yml.*$"
|
|
replace: ""
|
|
register: marker_ipv6_removed
|
|
#failed_when: "marker_ipv6_removed.rc > 1"
|
|
#changed_when: "marker_ipv6_removed.rc < 1"
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
|
|
# ---
|
|
# Confiuration Files
|
|
# ---
|
|
|
|
- name: Check if configuration files are latest
|
|
shell: 'diff {{ git_firewall_repository.dest }}/conf/{{ item }} /etc/ipt-firewall/{{ item }} > /dev/null 2>&1'
|
|
changed_when: "diff_script_output.rc > 0"
|
|
# diff_output.rc
|
|
# 0 -> unchanged
|
|
# 1 -> changed
|
|
# 2 -> not present
|
|
failed_when: "diff_script_output.rc > 2"
|
|
when: git_firewall_repository is defined and git_firewall_repository > 0
|
|
loop:
|
|
- default_ports.conf
|
|
- include_functions.conf
|
|
- load_modules_ipv4.conf
|
|
- load_modules_ipv6.conf
|
|
- logging_ipv4.conf
|
|
- logging_ipv6.conf
|
|
- post_decalrations.conf
|
|
register: diff_script_output
|
|
|
|
- name: Ensure configuration files are latest
|
|
command: cp {{ git_firewall_repository.dest }}/conf/{{ item }} /etc/ipt-firewall/{{ item }}
|
|
loop:
|
|
- default_ports.conf
|
|
- include_functions.conf
|
|
- load_modules_ipv4.conf
|
|
- load_modules_ipv6.conf
|
|
- logging_ipv4.conf
|
|
- logging_ipv6.conf
|
|
- post_decalrations.conf
|
|
when:
|
|
- git_firewall_repository is defined and git_firewall_repository > 0
|
|
- diff_script_output.changed
|
|
notify:
|
|
- Restart IPv4 Firewall
|
|
- Restart IPv6 Firewall
|
|
|
|
# ---
|
|
# Firewall scripts
|
|
# ---
|
|
|
|
- name: Check if firewall scripts are latest
|
|
shell: 'diff {{ git_firewall_repository.dest }}/{{ item }} /usr/local/sbin/{{ item }} > /dev/null 2>&1'
|
|
changed_when: "diff_script_output.rc > 0"
|
|
# diff_output.rc
|
|
# 0 -> unchanged
|
|
# 1 -> changed
|
|
# 2 -> not present
|
|
failed_when: "diff_script_output.rc > 2"
|
|
when: git_firewall_repository is defined and git_firewall_repository > 0
|
|
loop:
|
|
- ipt-firewall-gateway
|
|
- ip6t-firewall-gateway
|
|
register: diff_script_output
|
|
|
|
- name: Ensure firewall scripts are latest
|
|
command: cp {{ git_firewall_repository.dest }}/{{ item }} /usr/local/sbin/{{ item }}
|
|
loop:
|
|
- ipt-firewall-gateway
|
|
- ip6t-firewall-gateway
|
|
when:
|
|
- git_firewall_repository is defined and git_firewall_repository > 0
|
|
- diff_script_output.changed
|
|
notify:
|
|
- Restart IPv4 Firewall
|
|
- Restart IPv6 Firewall
|