servers/roles/proxmox/tasks/firewall.yml

- name: Set up firewall
  template:
    dest: /etc/pve/firewall/cluster.fw
    src: cluster.fw.j2
    mode: 0640
    owner: root
    group: www-data
  when: is_primary
proxmox: set up firewall Firewall policy is set in NetBox as cluster services¹. For Proxmox we have to manually allow communication between nodes when using L3, since the default management ipset does not get populated correctly. We also need to open VTEP communication between nodes, which the default rules don’t. We allow all inter-node traffic, as SSH without passwords must be permitted anyway. This also adds some helper filters that are spectacularly annoying to implement purely in templates. ¹ There is actually no such thing as as a cluster service (yet?), so instead we create a fake VM for the cluster, define services for it, and then add the same services to a custom field on the cluster. Alternative would be to tie services to a specific node, but that could be problematic if that node is replaced. 2024-04-05 04:00:50 +00:00			`- name: Set up firewall`
			`template:`
			`dest: /etc/pve/firewall/cluster.fw`
			`src: cluster.fw.j2`
			`mode: 0640`
			`owner: root`
			`group: www-data`
Factor frr role from debian, ceph and proxmox Consolidate base system and networking setup into debian role and BGP configuration into frr role. Add facts role to collect data from NetBox once to avoid many slow lookups. Also many other tweaks and cleanups. 2024-05-18 16:35:41 +00:00			`when: is_primary`