Add ceph role

Just prepares the servers, all management is then done through cephadm.

roles/ceph/templates/hosts.j2

@@ -0,0 +1,11 @@
+127.0.0.1 localhost
+::1 localhost ip6-localhost ip6-loopback
+ff02::1 ip6-allnodes
+ff02::2 ip6-allrouters
+
+{% set my_cluster = query('netbox.netbox.nb_lookup', 'clusters', raw_data=true, api_filter='name='~cluster) | first %}
+{% for host in query('netbox.netbox.nb_lookup', 'devices', raw_data=true, api_filter='cluster_id='~my_cluster.id) | map(attribute='name') %}
+{% for address in (hostvars[host].interfaces | selectattr('name', 'equalto', 'lo') | map(attribute='ip_addresses') | first) %}
+{{ address.address | ipaddr('address') }} {{ host }}
+{% endfor %}
+{% endfor %}

roles/ceph/templates/nftables.conf.j2

@@ -0,0 +1,33 @@
+#!/usr/sbin/nft -f
+
+flush ruleset
+
+# Just a temporary filter until we get our shit together policy-wise.
+table inet filter {
+    set allowed {
+        type ipv4_addr
+        flags interval
+        elements = { 10.32.0.0/14, 193.2.76.176/24, 192.168.19.0/24, 192.168.251.0/24 }
+    }
+
+    chain input {
+        type filter hook input priority filter; policy drop
+
+        ct state vmap { invalid : drop, established : accept, related : accept }
+        iif lo accept
+
+        # BGP / BFD sessions
+        iif lan0 ip6 saddr fe80::/64 accept
+        iif lan1 ip6 saddr fe80::/64 accept
+
+        ip saddr @allowed accept
+    }
+
+    chain forward {
+        type filter hook forward priority filter; policy accept
+    }
+
+    chain output {
+        type filter hook output priority filter; policy accept
+    }
+}