chrisandClaude Opus 5.5
402a6c9e89
- Update firewall scripts and shared conf files from firewall/ipt-server
(HTTP connection limits, IPv6 TCP MSS clamping, ban_ipv6_mask,
mattermost TCP fallback, rename 'stansard_*' -> 'standard_*').
- New role variables: fw_set_max_new_http_conn_per_ip_per_second,
fw_max_http_new_conn_per_ip_per_second, fw_set_max_concurrent_http_conn_per_ip,
fw_max_concurrent_http_conn_per_ip, fw_set_max_new_http_conn_per_second,
fw_max_new_http_conn_per_second, fw_throttle_tcp6_mss_for_https,
fw_tcp6_mss_for_https_val, fw_mm_tcp_ports_in, fw_ban_ipv6_mask.
- Split fw_blocked_ips into fw_blocked_ips_v4 / fw_blocked_ips_v6 and
rename it in host_vars accordingly.
- Restart firewall when scripts or shared conf files change.
- extract-fw-host-vars.py: map new variables, normalize '${var}' and renamed
bash variables, fall back to IPv6 for shared variables and warn if IPv4
and IPv6 values differ.
- README.md / MIGRATION.md: document host_vars naming
(<short-hostname>-ipt-server.yml) and new variables.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
225 lines
5.2 KiB
YAML
225 lines
5.2 KiB
YAML
---
|
|
|
|
# ===
|
|
# Ensure /etc/ipt-firewall directory exists
|
|
# ===
|
|
|
|
- name: Create /etc/ipt-firewall if not present
|
|
file:
|
|
path: /etc/ipt-firewall
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0750"
|
|
|
|
|
|
# ===
|
|
# Check presence of host-specific config files
|
|
# ===
|
|
|
|
- name: Check if interfaces_ipv4.conf exists
|
|
stat:
|
|
path: /etc/ipt-firewall/interfaces_ipv4.conf
|
|
register: interfaces_ipv4_exists
|
|
|
|
- name: Check if interfaces_ipv6.conf exists
|
|
stat:
|
|
path: /etc/ipt-firewall/interfaces_ipv6.conf
|
|
register: interfaces_ipv6_exists
|
|
|
|
- name: Check if main_ipv4.conf exists
|
|
stat:
|
|
path: /etc/ipt-firewall/main_ipv4.conf
|
|
register: main_ipv4_exists
|
|
|
|
- name: Check if main_ipv6.conf exists
|
|
stat:
|
|
path: /etc/ipt-firewall/main_ipv6.conf
|
|
register: main_ipv6_exists
|
|
|
|
|
|
# ===
|
|
# Deploy host-specific config files from templates.
|
|
#
|
|
# Safety guard: by default (fw_manage_config: false) a file is only written
|
|
# when it does not yet exist on the host — so existing hosts are never touched
|
|
# accidentally.
|
|
#
|
|
# Once a host has been migrated (host_vars populated and diff verified), set
|
|
# fw_manage_config: true
|
|
# in its host_vars. From that point on Ansible is the authoritative source and
|
|
# will update the config on every run, triggering a firewall restart on changes.
|
|
# ===
|
|
|
|
- name: Deploy interfaces_ipv4.conf from template
|
|
ansible.builtin.template:
|
|
src: etc/ipt-firewall/interfaces_ipv4.conf.j2
|
|
dest: /etc/ipt-firewall/interfaces_ipv4.conf
|
|
owner: root
|
|
group: root
|
|
mode: "0640"
|
|
when: fw_manage_config or not interfaces_ipv4_exists.stat.exists
|
|
notify:
|
|
- Restart IPv4 Firewall
|
|
|
|
- name: Deploy interfaces_ipv6.conf from template
|
|
ansible.builtin.template:
|
|
src: etc/ipt-firewall/interfaces_ipv6.conf.j2
|
|
dest: /etc/ipt-firewall/interfaces_ipv6.conf
|
|
owner: root
|
|
group: root
|
|
mode: "0640"
|
|
when: fw_manage_config or not interfaces_ipv6_exists.stat.exists
|
|
notify:
|
|
- Restart IPv6 Firewall
|
|
|
|
- name: Deploy main_ipv4.conf from template
|
|
ansible.builtin.template:
|
|
src: etc/ipt-firewall/main_ipv4.conf.j2
|
|
dest: /etc/ipt-firewall/main_ipv4.conf
|
|
owner: root
|
|
group: root
|
|
mode: "0640"
|
|
when: fw_manage_config or not main_ipv4_exists.stat.exists
|
|
notify:
|
|
- Restart IPv4 Firewall
|
|
|
|
- name: Deploy main_ipv6.conf from template
|
|
ansible.builtin.template:
|
|
src: etc/ipt-firewall/main_ipv6.conf.j2
|
|
dest: /etc/ipt-firewall/main_ipv6.conf
|
|
owner: root
|
|
group: root
|
|
mode: "0640"
|
|
when: fw_manage_config or not main_ipv6_exists.stat.exists
|
|
notify:
|
|
- Restart IPv6 Firewall
|
|
|
|
|
|
# ===
|
|
# Firewall scripts
|
|
# ===
|
|
|
|
- name: Deploy ipt-firewall-server
|
|
copy:
|
|
src: usr/local/sbin/ipt-firewall-server
|
|
dest: /usr/local/sbin/ipt-firewall-server
|
|
owner: root
|
|
group: root
|
|
mode: "0750"
|
|
notify:
|
|
- Restart IPv4 Firewall
|
|
|
|
- name: Deploy ip6t-firewall-server
|
|
copy:
|
|
src: usr/local/sbin/ip6t-firewall-server
|
|
dest: /usr/local/sbin/ip6t-firewall-server
|
|
owner: root
|
|
group: root
|
|
mode: "0750"
|
|
notify:
|
|
- Restart IPv6 Firewall
|
|
|
|
|
|
# ===
|
|
# Shared conf files (not host-specific — always kept in sync with the role)
|
|
# ===
|
|
|
|
- name: Deploy shared conf files
|
|
copy:
|
|
src: "etc/ipt-firewall/{{ item }}"
|
|
dest: "/etc/ipt-firewall/{{ item }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0640"
|
|
loop:
|
|
- default_settings.conf
|
|
- include_functions.conf
|
|
- logging_ipv4.conf
|
|
- logging_ipv6.conf
|
|
- post_declarations.conf
|
|
# Shared files are sourced by both scripts; logging_ipv4/6 only by one,
|
|
# but restarting both keeps this simple.
|
|
notify:
|
|
- Restart IPv4 Firewall
|
|
- Restart IPv6 Firewall
|
|
|
|
|
|
# ===
|
|
# Ban lists — copy from sample once; the file can be customised per host.
|
|
# ===
|
|
|
|
- name: Check if ban_ipv4.list exists
|
|
stat:
|
|
path: /etc/ipt-firewall/ban_ipv4.list
|
|
register: ban_ipv4_exists
|
|
|
|
- name: Copy ban_ipv4.list from sample (first install only)
|
|
copy:
|
|
src: etc/ipt-firewall/ban_ipv4.list.sample
|
|
dest: /etc/ipt-firewall/ban_ipv4.list
|
|
owner: root
|
|
group: root
|
|
mode: "0640"
|
|
when: not ban_ipv4_exists.stat.exists
|
|
|
|
- name: Check if ban_ipv6.list exists
|
|
stat:
|
|
path: /etc/ipt-firewall/ban_ipv6.list
|
|
register: ban_ipv6_exists
|
|
|
|
- name: Copy ban_ipv6.list from sample (first install only)
|
|
copy:
|
|
src: etc/ipt-firewall/ban_ipv6.list.sample
|
|
dest: /etc/ipt-firewall/ban_ipv6.list
|
|
owner: root
|
|
group: root
|
|
mode: "0640"
|
|
when: not ban_ipv6_exists.stat.exists
|
|
|
|
|
|
# ===
|
|
# Systemd service units
|
|
# ===
|
|
|
|
- name: Deploy ipt-firewall.service
|
|
copy:
|
|
src: etc/systemd/system/ipt-firewall.service
|
|
dest: /etc/systemd/system/ipt-firewall.service
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify:
|
|
- Reload systemd daemon
|
|
- Restart IPv4 Firewall
|
|
|
|
- name: Deploy ip6t-firewall.service
|
|
copy:
|
|
src: etc/systemd/system/ip6t-firewall.service
|
|
dest: /etc/systemd/system/ip6t-firewall.service
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify:
|
|
- Reload systemd daemon
|
|
- Restart IPv6 Firewall
|
|
|
|
|
|
# ===
|
|
# Enable and start services
|
|
# ===
|
|
|
|
- name: Enable and start ipt-firewall
|
|
systemd:
|
|
name: ipt-firewall
|
|
enabled: true
|
|
state: started
|
|
daemon_reload: true
|
|
|
|
- name: Enable and start ip6t-firewall
|
|
systemd:
|
|
name: ip6t-firewall
|
|
enabled: true
|
|
state: started
|
|
daemon_reload: true
|