alpine: set up firewall

Get services from NetBox and enable SSH unconditionally for now.
This commit is contained in:
Timotej Lazar 2024-06-05 15:37:45 +02:00
parent b3aff08ce3
commit fe6c35edf1
3 changed files with 42 additions and 0 deletions

View file

@ -4,6 +4,12 @@
state: reloaded state: reloaded
when: "'handler' not in ansible_skip_tags" when: "'handler' not in ansible_skip_tags"
- name: reload nftables
service:
name: nftables
state: reloaded
when: "'handler' not in ansible_skip_tags"
- name: update package cache - name: update package cache
package: package:
update_cache: true update_cache: true

View file

@ -30,6 +30,18 @@
value: 'prohibit-password' value: 'prohibit-password'
notify: reload sshd notify: reload sshd
- name: Set up firewall
template:
dest: /etc/nftables.d/local.nft
src: local.nft.j2
notify: reload nftables
- name: Enable firewall
service:
name: nftables
enabled: yes
state: started
- name: Enable QEMU guest agent - name: Enable QEMU guest agent
when: is_virtual when: is_virtual
block: block:

View file

@ -0,0 +1,24 @@
table inet filter {
chain input {
tcp dport ssh accept
{% for service in services %}
{% set prefixes = service | allowed_prefixes %}
{% set prefixes4 = prefixes | selectattr('family.value', '==', 4) | map('string') %}
{% set prefixes6 = prefixes | selectattr('family.value', '==', 6) | map('string') %}
{% set ports = service.ports | compact_numlist %}
# service {{ service.name }}
{% if prefixes4 or prefixes6 %}
{% if prefixes4 %}
ip saddr { {{ prefixes4 | join(', ') }} } tcp dport { {{ ports }} } accept
{% endif %}
{% if prefixes6 %}
ip6 saddr { {{ prefixes6 | join(', ') }} } tcp dport { {{ ports }} } accept
{% endif %}
{% else %}
tcp dport { {{ ports }} } accept
{% endif %}
{% endfor %}
}
}