rc/servers
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Consolidate nftables setup for alpine, debian and ceph roles

Browse source
This commit is contained in:
Timotej Lazar 2025-02-12 17:24:24 +01:00
parent bfda7b3236
commit 0d60aa107f
8 changed files with 76 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

4
roles/alpine/tasks/main.yml
View file

@ -74,8 +74,8 @@
- name: Set up firewall
template:
dest: /etc/nftables.d/local.nft
src: local.nft.j2
dest: /etc/nftables.d/services.nft
src: services.nft.j2
notify: reload nftables
- name: Enable firewall

22
roles/alpine/templates/local.nft.j2
View file

@ -1,22 +0,0 @@
table inet filter {
chain input {
{% for service in services %}
{% set prefixes = service | allowed_prefixes %}
{% set ports = service.ports | compact_numlist %}
{% if 'name' in service %}
# service {{ service.name }}
{% endif %}
{% if prefixes %}
{% if prefixes | ipv4 %}
ip saddr { {{ prefixes | ipv4 | join(', ') }} } {{ service.protocol.value }} dport { {{ ports }} } accept
{% endif %}
{% if prefixes | ipv6 %}
ip6 saddr { {{ prefixes | ipv6 | join(', ') }} } {{ service.protocol.value }} dport { {{ ports }} } accept
{% endif %}
{% else %}
{{ service.protocol.value }} dport { {{ ports }} } accept
{% endif %}
{% endfor %}
}
}