chrisandClaude Opus 5.5
ecc2ae2fbe
- handlers: a firewall restart flushes the DOCKER* chains and docker's NAT
rules; restart docker afterwards if it is running (like fail2ban).
- host_vars: add values missing from host_vars generated by an older
extract-fw-host-vars.py:
- mm-irights, mm-nd, mm-rav: fw_mm_server_ips
- test.mx: fw_mail_client_ips_v6, fw_dovecot_auth_service_v6,
fw_mumble_server_ips_v6
- mm: fw_allow_local_service_v6 uses "<port>,<proto>" (the IPv6 script
splits on ',', the IPv4 script on ':').
Rolled out to a.mx, a.ns, b.mx, b.ns, backup.warenform, cl-01, cl-02,
cl-dissens, cl-flr, cl-irights, cl-nd-test, cl-ndm, mm, mm-irights, mm-nd,
mm-rav, o45, test.mx; second run changed=0 on all of them.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
# ====================
# Encrypting content with Ansible Vault
# ====================
# see:
# https://docs.ansible.com/ansible/latest/vault_guide
#
# https://docs.ansible.com/ansible/latest/vault_guide/vault_encrypting_content.html
# ----------
# encrypt / decrypt variables / strings
# ---------
# encrypt string
#
string=nSLIgazSj8DLu2Sy0l
ansible-vault encrypt_string $string && echo
# output of the above command is:
#
!vault |
$ANSIBLE_VAULT;1.1;AES256
33656466386662303431383037386564666466643364376233623261346235363866656438396532
6161373832366430653235343034653166303561383934390a666432356463386461656363303234
61386330643664666539343336313666346261323435386264396137366533626539396434303463
3961666632646337360a666662323063316134623332333239616332343939326331383632646139
66316333653232383764376264616238323861323530343734653564393737386139
# decrypt the encrypted string:
#
echo -e '$ANSIBLE_VAULT;1.1;AES256
33656466386662303431383037386564666466643364376233623261346235363866656438396532
6161373832366430653235343034653166303561383934390a666432356463386461656363303234
61386330643664666539343336313666346261323435386264396137366533626539396434303463
3961666632646337360a666662323063316134623332333239616332343939326331383632646139
66316333653232383764376264616238323861323530343734653564393737386139' | ansible-vault decrypt && echo
# output shoud be:
#
Decryption successful
nSLIgazSj8DLu2Sy0l
# ----------
# encrypt / decrypt file
# ----------
ansible-vault encrypt <file-name>
ansible-vault decrypt <file-name>