Timotej Lazar
29598ef4bb
Allow running playbooks without NetBox access. Mainly to bootstrap NetBox itself. Would prefer not to access network from filter plugins, so maybe do that at some point also.
24 lines
1 KiB
Django/Jinja
24 lines
1 KiB
Django/Jinja
[OPTIONS]
|
|
|
|
enable: 1
|
|
|
|
[RULES]
|
|
|
|
IN Ping(ACCEPT) -log nolog # don’t be rude
|
|
IN SSH(ACCEPT) -i mgmt # for ansible etc.
|
|
IN ACCEPT -source {{ nodes | map('device_address') | flatten | selectattr('family.value', '==', 4) | map(attribute='address') | join(',') }} # my cluster
|
|
IN ACCEPT -source {{ nodes | map('device_address') | flatten | selectattr('family.value', '==', 6) | map(attribute='address') | join(',') }} # my cluster
|
|
{% for service in cluster_services %}
|
|
{% set prefixes = service | allowed_prefixes %}
|
|
{% set prefixes4 = prefixes | selectattr('family.value', '==', 4) | map('string') %}
|
|
{% set prefixes6 = prefixes | selectattr('family.value', '==', 6) | map('string') %}
|
|
{% set ports = service.ports | compact_numlist(range_delimiter=':') %}
|
|
{% if prefixes4 %}
|
|
IN ACCEPT -source {{ prefixes4 | join(',') }} -p {{ service.protocol.value }} -dport {{ ports }} # {{ service.name }}
|
|
{% endif %}
|
|
{% if prefixes6 %}
|
|
IN ACCEPT -source {{ prefixes6 | join(',') }} -p {{ service.protocol.value }} -dport {{ ports }} # {{ service.name }}
|
|
{% endif %}
|
|
{% endfor %}
|
|
|