Timotej Lazar
46a9ff6fc0
With a hook to restart RGW services on renewal, if there are any. Live
certificates are linked to the same path under /etc/ceph on each host,
so that the orch service spec is node-independent.
Use with something like this (port 80 must be kept free for standalone
certbot renewal):
service_type: rgw
spec:
rgw_frontend_port: 8080
rgw_frontend_extra_args:
- ssl_port=443
- ssl_private_key=/etc/ceph/privkey.pem
- ssl_certificate=/etc/ceph/fullchain.pem
extra_container_args:
- "--volume"
- "/etc/ceph:/etc/ceph:ro"
- "--volume"
- "/etc/letsencrypt:/etc/letsencrypt:ro"
81 lines
2.6 KiB
Django/Jinja
81 lines
2.6 KiB
Django/Jinja
#!/usr/sbin/nft -f
|
|
|
|
flush ruleset
|
|
|
|
table inet filter {
|
|
set cluster {
|
|
type ipv4_addr; flags interval; auto-merge
|
|
elements = {
|
|
{{ nodes | map('device_address') | flatten | selectattr('family.value', '==', 4) | map(attribute='address') | join(',\n') | indent(12, first=True) }}
|
|
}
|
|
}
|
|
set cluster/6 {
|
|
type ipv6_addr; flags interval; auto-merge
|
|
elements = {
|
|
{{ nodes | map('device_address') | flatten | selectattr('family.value', '==', 6) | map(attribute='address') | join(',\n') | indent(12, first=True) }}
|
|
}
|
|
}
|
|
|
|
# Just a temporary filter until we get our shit together policy-wise.
|
|
set allowed {
|
|
type ipv4_addr; flags interval
|
|
elements = { 10.32.0.0/14, 193.2.76.176/24, 192.168.251.0/24, 88.200.23.0/24 }
|
|
}
|
|
set allowed/6 {
|
|
type ipv6_addr; flags interval
|
|
elements = { 2001:1470:fffd:3432::/64, 2001:1470:fffd:a000::/64 }
|
|
}
|
|
|
|
chain input {
|
|
type filter hook input priority filter; policy drop
|
|
|
|
ct state vmap { invalid : drop, established : accept, related : accept }
|
|
iif lo accept
|
|
|
|
ip protocol icmp icmp type {
|
|
echo-request, echo-reply, destination-unreachable,
|
|
parameter-problem, time-exceeded,
|
|
} accept comment "accept some ICMPv4"
|
|
|
|
ip6 nexthdr icmpv6 icmpv6 type {
|
|
echo-request, echo-reply, destination-unreachable,
|
|
packet-too-big, parameter-problem, time-exceeded,
|
|
} accept comment "accept some ICMPv6"
|
|
|
|
# BGP / BFD sessions
|
|
iif lan0 ip6 saddr fe80::/64 accept
|
|
iif lan1 ip6 saddr fe80::/64 accept
|
|
|
|
iifname mgmt accept comment "management access"
|
|
|
|
ip saddr @cluster accept comment "accept connections from other nodes"
|
|
ip6 saddr @cluster/6 accept comment "accept connections from other nodes"
|
|
|
|
ip saddr @allowed accept # TODO remove exceptions
|
|
ip6 saddr @allowed/6 accept # TODO remove exceptions
|
|
|
|
meta nfproto ipv6 tcp dport 80 accept comment "for certificate renewal"
|
|
|
|
{% for service in cluster_services %}
|
|
{% set prefixes = service | allowed_prefixes %}
|
|
{% set ports = service.ports | compact_numlist %}
|
|
# service {{ service.name }}
|
|
{% if prefixes | ipv4 %}
|
|
ip saddr { {{ prefixes | ipv4 | join(', ') }} } tcp dport { {{ ports }} } accept
|
|
{% endif %}
|
|
{% if prefixes | ipv6 %}
|
|
ip6 saddr { {{ prefixes | ipv6 | join(', ') }} } tcp dport { {{ ports }} } accept
|
|
{% endif %}
|
|
|
|
{% endfor %}
|
|
}
|
|
|
|
chain forward {
|
|
type filter hook forward priority filter; policy accept
|
|
}
|
|
|
|
chain output {
|
|
type filter hook output priority filter; policy accept
|
|
}
|
|
}
|