442 lines
14 KiB
YAML
442 lines
14 KiB
YAML
---
|
|
|
|
- hosts: all
|
|
|
|
tasks:
|
|
|
|
- name: Check if file '/etc/ipt-firewall/main_ipv6.conf' exists
|
|
stat:
|
|
path: /etc/ipt-firewall/main_ipv6.conf
|
|
register: main_ipv4_exists
|
|
|
|
- name: Check if file '/etc/ipt-firewall/main_ipv4.conf' exists
|
|
stat:
|
|
path: /etc/ipt-firewall/main_ipv4.conf
|
|
register: main_ipv6_exists
|
|
|
|
# ---
|
|
# vpn_ports
|
|
# ---
|
|
|
|
- name: Check if String 'vpn_ports=..' is present
|
|
shell: grep -q -E "^vpn_ports=" /etc/ipt-firewall/main_ipv4.conf
|
|
register: vpn_ports_ipv4_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "vpn_ports_ipv4_present.rc > 1"
|
|
changed_when: "vpn_ports_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (vpn_ports)
|
|
blockinfile:
|
|
path: /etc/ipt-firewall/main_ipv4.conf
|
|
insertafter: '^#?\s*forward_vpn_server_ips'
|
|
block: |
|
|
# - VPN Port(s) used by local Services
|
|
# -
|
|
# - blank separated list
|
|
# -
|
|
vpn_ports="$standard_vpn_port"
|
|
|
|
marker: "# Marker set by modify-ipt-server.yml (vpn_ports)"
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
- vpn_ports_ipv4_present is changed
|
|
|
|
- name: Check if String 'vpn_ports=..' is present
|
|
shell: grep -q -E "^vpn_ports=" /etc/ipt-firewall/main_ipv6.conf
|
|
register: vpn_ports_ipv6_present
|
|
when: main_ipv6_exists.stat.exists
|
|
failed_when: "vpn_ports_ipv6_present.rc > 1"
|
|
changed_when: "vpn_ports_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (vpn_ports)
|
|
blockinfile:
|
|
path: /etc/ipt-firewall/main_ipv6.conf
|
|
insertafter: '^#?\s*forward_vpn_server_ips'
|
|
block: |
|
|
# - VPN Port(s) used by local Services
|
|
# -
|
|
# - blank separated list
|
|
# -
|
|
vpn_ports="$standard_vpn_port"
|
|
|
|
marker: "# Marker set by modify-ipt-server.yml (vpn_ports)"
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
- vpn_ports_ipv6_present is changed
|
|
|
|
# ---
|
|
# ssh_ports
|
|
# ---
|
|
|
|
- name: Check if String 'ssh_ports=..' is present
|
|
shell: grep -q -E "^ssh_ports=" /etc/ipt-firewall/main_ipv4.conf
|
|
register: ssh_ports_ipv4_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "ssh_ports_ipv4_present.rc > 1"
|
|
changed_when: "ssh_ports_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (ssh_ports)
|
|
blockinfile:
|
|
path: /etc/ipt-firewall/main_ipv4.conf
|
|
insertafter: '^#?\s*forward_ssh_server_ips'
|
|
block: |
|
|
# - SSH Port(s) used by local Services
|
|
# -
|
|
# - blank separated list
|
|
# -
|
|
ssh_ports="$standard_ssh_port"
|
|
|
|
marker: "# Marker set by modify-ipt-server.yml (ssh_ports)"
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
- ssh_ports_ipv4_present is changed
|
|
|
|
- name: Check if String 'ssh_ports=..' is present
|
|
shell: grep -q -E "^ssh_ports=" /etc/ipt-firewall/main_ipv6.conf
|
|
register: ssh_ports_ipv6_present
|
|
when: main_ipv6_exists.stat.exists
|
|
failed_when: "ssh_ports_ipv6_present.rc > 1"
|
|
changed_when: "ssh_ports_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (ssh_ports)
|
|
blockinfile:
|
|
path: /etc/ipt-firewall/main_ipv6.conf
|
|
insertafter: '^#?\s*forward_ssh_server_ips'
|
|
block: |
|
|
# - SSH Port(s) used by local Services
|
|
# -
|
|
# - blank separated list
|
|
# -
|
|
ssh_ports="$standard_ssh_port"
|
|
|
|
marker: "# Marker set by modify-ipt-server.yml (ssh_ports)"
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
- ssh_ports_ipv6_present is changed
|
|
|
|
# ---
|
|
# http_ports
|
|
# ---
|
|
|
|
- name: Check if String 'http_ports=..' is present
|
|
shell: grep -q -E "^http_ports=" /etc/ipt-firewall/main_ipv4.conf
|
|
register: http_ports_ipv4_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "http_ports_ipv4_present.rc > 1"
|
|
changed_when: "http_ports_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (http_ports)
|
|
blockinfile:
|
|
path: /etc/ipt-firewall/main_ipv4.conf
|
|
insertafter: '^#?\s*forward_http_server_ips'
|
|
block: |
|
|
# - HTTP(S) Ports used by local Services
|
|
# -
|
|
# - comma separated list
|
|
# -
|
|
http_ports="$standard_http_ports"
|
|
|
|
marker: "# Marker set by modify-ipt-server.yml (http_ports)"
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
- http_ports_ipv4_present is changed
|
|
|
|
- name: Check if String 'http_ports=..' is present
|
|
shell: grep -q -E "^http_ports=" /etc/ipt-firewall/main_ipv6.conf
|
|
register: http_ports_ipv6_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "http_ports_ipv6_present.rc > 1"
|
|
changed_when: "http_ports_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (http_ports)
|
|
blockinfile:
|
|
path: /etc/ipt-firewall/main_ipv6.conf
|
|
insertafter: '^#?\s*forward_http_server_ips'
|
|
block: |
|
|
# - HTTP(S) Ports used by local Services
|
|
# -
|
|
# - comma separated list
|
|
# -
|
|
http_ports="$standard_http_ports"
|
|
|
|
marker: "# Marker set by modify-ipt-server.yml (http_ports)"
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
- http_ports_ipv6_present is changed
|
|
|
|
# ---
|
|
# mail_user_ports
|
|
# ---
|
|
|
|
- name: Check if String 'mail_user_ports=..' is present
|
|
shell: grep -q -E "^mail_user_ports=" /etc/ipt-firewall/main_ipv4.conf
|
|
register: mail_user_ports_ipv4_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "mail_user_ports_ipv4_present.rc > 1"
|
|
changed_when: "mail_user_ports_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (mail_user_ports)
|
|
blockinfile:
|
|
path: /etc/ipt-firewall/main_ipv4.conf
|
|
insertafter: '^#?\s*forward_mail_server_ips'
|
|
block: |
|
|
# - Client Ports used by local Mail Services
|
|
# -
|
|
# - comma separated list
|
|
# -
|
|
mail_user_ports="$standard_mailuser_ports"
|
|
|
|
marker: "# Marker set by modify-ipt-server.yml (mail_user_ports)"
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
- mail_user_ports_ipv4_present is changed
|
|
|
|
- name: Check if String 'mail_user_ports=..' is present
|
|
shell: grep -q -E "^mail_user_ports=" /etc/ipt-firewall/main_ipv6.conf
|
|
register: mail_user_ports_ipv6_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "mail_user_ports_ipv6_present.rc > 1"
|
|
changed_when: "mail_user_ports_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (mail_user_ports)
|
|
blockinfile:
|
|
path: /etc/ipt-firewall/main_ipv6.conf
|
|
insertafter: '^#?\s*forward_mail_server_ips'
|
|
block: |
|
|
# - Client Ports used by local Mail Services
|
|
# -
|
|
# - comma separated list
|
|
# -
|
|
mail_user_ports="$standard_mailuser_ports"
|
|
|
|
marker: "# Marker set by modify-ipt-server.yml (mail_user_ports)"
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
- mail_user_ports_ipv6_present is changed
|
|
|
|
# ---
|
|
# ftp_passive_port_range
|
|
# ---
|
|
|
|
- name: Check if String 'ftp_passive_port_range=..' is present
|
|
shell: grep -q -E "^ftp_passive_port_range=" /etc/ipt-firewall/main_ipv4.conf
|
|
register: ftp_passive_port_range_ipv4_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "ftp_passive_port_range_ipv4_present.rc > 1"
|
|
changed_when: "ftp_passive_port_range_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (ftp_passive_port_range)
|
|
blockinfile:
|
|
path: /etc/ipt-firewall/main_ipv4.conf
|
|
insertafter: '^#?\s*forward_ftp_server_ips'
|
|
block: |
|
|
# - FTP passive port range use by local ftp service(s)
|
|
# -
|
|
# - example: ftp_passive_port_range="50000:50400"
|
|
# -
|
|
ftp_passive_port_range="50000:50400"
|
|
|
|
marker: "# Marker set by modify-ipt-server.yml (ftp_passive_port_range)"
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
- ftp_passive_port_range_ipv4_present is changed
|
|
|
|
- name: Check if String 'ftp_passive_port_range=..' is present
|
|
shell: grep -q -E "^ftp_passive_port_range=" /etc/ipt-firewall/main_ipv6.conf
|
|
register: ftp_passive_port_range_ipv6_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "ftp_passive_port_range_ipv6_present.rc > 1"
|
|
changed_when: "ftp_passive_port_range_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (ftp_passive_port_range)
|
|
blockinfile:
|
|
path: /etc/ipt-firewall/main_ipv6.conf
|
|
insertafter: '^#?\s*forward_ftp_server_ips'
|
|
block: |
|
|
# - FTP passive port range use by local ftp service(s)
|
|
# -
|
|
# - example: ftp_passive_port_range="50000:50400"
|
|
# -
|
|
ftp_passive_port_range="50000:50400"
|
|
|
|
marker: "# Marker set by modify-ipt-server.yml (ftp_passive_port_range)"
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
- ftp_passive_port_range_ipv6_present is changed
|
|
|
|
# ---
|
|
# munin_remote_port
|
|
# ---
|
|
|
|
- name: Check if String 'munin_remote_port=..' is present
|
|
shell: grep -q -E "^munin_remote_port=" /etc/ipt-firewall/main_ipv4.conf
|
|
register: munin_remote_port_ipv4_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "munin_remote_port_ipv4_present.rc > 1"
|
|
changed_when: "munin_remote_port_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (munin_remote_port)
|
|
blockinfile:
|
|
path: /etc/ipt-firewall/main_ipv4.conf
|
|
insertafter: '^#?\s*forward_munin_server_ips'
|
|
block: |
|
|
# - Port used by clients hosted on this (local) Munin Services
|
|
# -
|
|
# - !! Only one port is possible !!
|
|
# -
|
|
munin_remote_port="$standard_munin_port"
|
|
|
|
marker: "# Marker set by modify-ipt-server.yml (munin_remote_port)"
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
- munin_remote_port_ipv4_present is changed
|
|
|
|
- name: Check if String 'munin_remote_port=..' is present
|
|
shell: grep -q -E "^munin_remote_port=" /etc/ipt-firewall/main_ipv6.conf
|
|
register: munin_remote_port_ipv6_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "munin_remote_port_ipv6_present.rc > 1"
|
|
changed_when: "munin_remote_port_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (munin_remote_port)
|
|
blockinfile:
|
|
path: /etc/ipt-firewall/main_ipv6.conf
|
|
insertafter: '^#?\s*forward_munin_server_ips'
|
|
block: |
|
|
# - Ports used by clients hosted on this (local) Munin Services
|
|
# -
|
|
# - !! Only one port is possible !!
|
|
# -
|
|
munin_remote_port="$standard_munin_port"
|
|
|
|
marker: "# Marker set by modify-ipt-server.yml (munin_remote_port)"
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
- munin_remote_port_ipv6_present is changed
|
|
|
|
# ---
|
|
# xymon_port
|
|
# ---
|
|
|
|
- name: Check if String 'xymon_port=..' is present
|
|
shell: grep -q -E "^xymon_port=" /etc/ipt-firewall/main_ipv4.conf
|
|
register: xymon_port_ipv4_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "xymon_port_ipv4_present.rc > 1"
|
|
changed_when: "xymon_port_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (xymon_port)
|
|
blockinfile:
|
|
path: /etc/ipt-firewall/main_ipv4.conf
|
|
insertafter: '^#?\s*local_xymon_client'
|
|
block: |
|
|
# - Port used by local Xymon Services
|
|
# -
|
|
# - !! Only one port is possible !!
|
|
# -
|
|
xymon_port="$standard_xymon_port"
|
|
|
|
marker: "# Marker set by modify-ipt-server.yml (xymon_port)"
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
- xymon_port_ipv4_present is changed
|
|
|
|
- name: Check if String 'xymon_port=..' is present
|
|
shell: grep -q -E "^xymon_port=" /etc/ipt-firewall/main_ipv6.conf
|
|
register: xymon_port_ipv6_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "xymon_port_ipv6_present.rc > 1"
|
|
changed_when: "xymon_port_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (xymon_port)
|
|
blockinfile:
|
|
path: /etc/ipt-firewall/main_ipv6.conf
|
|
insertafter: '^#?\s*local_xymon_client'
|
|
block: |
|
|
# - Port used by local Xymon Services
|
|
# -
|
|
# - !! Only one port is possible !!
|
|
# -
|
|
xymon_port="$standard_xymon_port"
|
|
|
|
marker: "# Marker set by modify-ipt-server.yml (xymon_port)"
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
- xymon_port_ipv6_present is changed
|
|
|
|
# ---
|
|
# mumble_ports
|
|
# ---
|
|
|
|
- name: Check if String 'mumble_ports=..' is present
|
|
shell: grep -q -E "^mumble_ports=" /etc/ipt-firewall/main_ipv4.conf
|
|
register: mumble_ports_ipv4_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "mumble_ports_ipv4_present.rc > 1"
|
|
changed_when: "mumble_ports_ipv4_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (mumble_ports)
|
|
blockinfile:
|
|
path: /etc/ipt-firewall/main_ipv4.conf
|
|
insertafter: '^#?\s*forward_mumble_server_ips'
|
|
block: |
|
|
# - Ports used by local Mumble Services
|
|
# -
|
|
# - comma separated list
|
|
# -
|
|
mumble_ports="$standard_mumble_port"
|
|
|
|
marker: "# Marker set by modify-ipt-server.yml (mumble_ports)"
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
- mumble_ports_ipv4_present is changed
|
|
|
|
- name: Check if String 'mumble_ports=..' is present
|
|
shell: grep -q -E "^mumble_ports=" /etc/ipt-firewall/main_ipv6.conf
|
|
register: mumble_ports_ipv6_present
|
|
when: main_ipv4_exists.stat.exists
|
|
failed_when: "mumble_ports_ipv6_present.rc > 1"
|
|
changed_when: "mumble_ports_ipv6_present.rc > 0"
|
|
|
|
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (mumble_ports)
|
|
blockinfile:
|
|
path: /etc/ipt-firewall/main_ipv6.conf
|
|
insertafter: '^#?\s*forward_mumble_server_ips'
|
|
block: |
|
|
# - Ports used by local Mumble Services
|
|
# -
|
|
# - comma separated list
|
|
# -
|
|
mumble_ports="$standard_mumble_port"
|
|
|
|
marker: "# Marker set by modify-ipt-server.yml (mumble_ports)"
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|
|
- mumble_ports_ipv6_present is changed
|
|
|
|
# ---
|
|
# Remove Marker set by blockinfile
|
|
# ---
|
|
|
|
- name: Remove marker IPv4
|
|
replace :
|
|
path: /etc/ipt-firewall/main_ipv4.conf
|
|
regexp: "^# Marker set by modify-ipt-server.yml.*$"
|
|
replace: ""
|
|
register: marker_ipv4_removed
|
|
#failed_when: "marker_ipv4_removed.rc > 1"
|
|
#changed_when: "marker_ipv4_removed.rc < 1"
|
|
when:
|
|
- main_ipv4_exists.stat.exists
|
|
|
|
- name: Remove marker IPv6
|
|
replace :
|
|
path: /etc/ipt-firewall/main_ipv6.conf
|
|
regexp: "^# Marker set by modify-ipt-server.yml.*$"
|
|
replace: ""
|
|
register: marker_ipv6_removed
|
|
#failed_when: "marker_ipv6_removed.rc > 1"
|
|
#changed_when: "marker_ipv6_removed.rc < 1"
|
|
when:
|
|
- main_ipv6_exists.stat.exists
|