chrisandClaude Opus 5.5
ecc2ae2fbe
- handlers: a firewall restart flushes the DOCKER* chains and docker's NAT
rules; restart docker afterwards if it is running (like fail2ban).
- host_vars: add values missing from host_vars generated by an older
extract-fw-host-vars.py:
- mm-irights, mm-nd, mm-rav: fw_mm_server_ips
- test.mx: fw_mail_client_ips_v6, fw_dovecot_auth_service_v6,
fw_mumble_server_ips_v6
- mm: fw_allow_local_service_v6 uses "<port>,<proto>" (the IPv6 script
splits on ',', the IPv4 script on ':').
Rolled out to a.mx, a.ns, b.mx, b.ns, backup.warenform, cl-01, cl-02,
cl-dissens, cl-flr, cl-irights, cl-nd-test, cl-ndm, mm, mm-irights, mm-nd,
mm-rav, o45, test.mx; second run changed=0 on all of them.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
46 lines
1.2 KiB
YAML
46 lines
1.2 KiB
YAML
---
|
|
|
|
- name: Reload systemd daemon
|
|
systemd:
|
|
daemon_reload: true
|
|
|
|
- name: Restart IPv4 Firewall
|
|
service:
|
|
name: ipt-firewall
|
|
state: restarted
|
|
notify:
|
|
- Restart fail2ban if active
|
|
- Restart docker if active
|
|
|
|
- name: Restart IPv6 Firewall
|
|
service:
|
|
name: ip6t-firewall
|
|
state: restarted
|
|
notify:
|
|
- Restart fail2ban if active
|
|
- Restart docker if active
|
|
|
|
# A firewall restart flushes the fail2ban chains; restarting fail2ban
|
|
# recreates them and re-applies the active bans. Does nothing if fail2ban
|
|
# is not installed or not running.
|
|
- name: Restart fail2ban if active
|
|
shell: |
|
|
if systemctl is-active --quiet fail2ban ; then
|
|
systemctl restart fail2ban
|
|
echo restarted
|
|
fi
|
|
register: fail2ban_restart
|
|
changed_when: "'restarted' in fail2ban_restart.stdout"
|
|
|
|
# A firewall restart also flushes the DOCKER* chains and the NAT rules of
|
|
# docker; restarting docker recreates them (and restarts the containers).
|
|
# Does nothing if docker is not installed or not running.
|
|
- name: Restart docker if active
|
|
shell: |
|
|
if systemctl is-active --quiet docker ; then
|
|
systemctl restart docker
|
|
echo restarted
|
|
fi
|
|
register: docker_restart
|
|
changed_when: "'restarted' in docker_restart.stdout"
|