WoodSmellParticle/ansible-infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(security): allow all registered provisioners to connect without limitations instead of the one running playbooks only

Browse source
This commit is contained in:
NaeiKinDus 2024-07-11 00:00:00 +00:00
parent 332e367c3c
commit 14a46715c7
Signed by: WoodSmellParticle
GPG key ID: 8E52ADFF7CA8AE56
4 changed files with 17 additions and 48 deletions
Download patch file Download diff file Expand all files Collapse all files

7
collections/ansible_collections/nullified/infrastructure/roles/security/templates/system/debian/nftables.conf.j2
View file

@ -2,9 +2,10 @@
flush ruleset
{% if security_firewall_supervisor_ip -%}
define ansible_controller_ip = {{ security_firewall_supervisor_ip }}
{% endif -%}
define ansible_controllers_ip4 = {
{{ security_firewall_supervisors_ip4 | join(", ") | wordwrap(40, wrapstring="\n ") }}
}
define ansible_controllers_ip6 = { }
{% if security_firewall_dns4_servers -%}
define dns_servers = {
{{ security_firewall_dns4_servers | join(", ") | wordwrap(40, wrapstring="\n\t") }}

26
collections/ansible_collections/nullified/infrastructure/roles/security/templates/system/nftables/02-mangle.table.j2
View file

@ -22,15 +22,10 @@ table inet mangle {
tcp flags & (fin|syn|rst|psh|ack|urg) == fin|syn|psh|urg counter drop
tcp flags & (fin|syn|rst|psh|ack|urg) == fin|syn|rst|ack|urg counter drop
{% if security_firewall_supervisor_ip -%}
{% if security_firewall_supervisor_has_ip6 -%}
ip6 saddr $ansible_controller_ip tcp dport $ssh_localport accept
ip6 daddr $ansible_controller_ip tcp sport $ssh_localport accept
{% else -%}
ip saddr $ansible_controller_ip tcp dport $ssh_localport accept
ip daddr $ansible_controller_ip tcp sport $ssh_localport accept
{%- endif +%}
{% endif -%}
ip6 saddr $ansible_controllers_ip6 tcp dport $ssh_localport accept
ip6 daddr $ansible_controllers_ip6 tcp sport $ssh_localport accept
ip saddr $ansible_controllers_ip4 tcp dport $ssh_localport accept
ip daddr $ansible_controllers_ip4 tcp sport $ssh_localport accept
{% if security_firewall_mangle_drop_privatenets -%}
ip saddr $private_nets counter drop
@ -50,14 +45,9 @@ table inet mangle {
chain postrouting {
type filter hook postrouting priority -150; policy {{ security_firewall_mangle_policy_postrouting }};
{% if security_firewall_supervisor_ip -%}
{% if security_firewall_supervisor_has_ip6 -%}
ip6 saddr $ansible_controller_ip tcp dport $ssh_localport accept
ip6 daddr $ansible_controller_ip tcp sport $ssh_localport accept
{%- else -%}
ip saddr $ansible_controller_ip tcp dport $ssh_localport accept
ip daddr $ansible_controller_ip tcp sport $ssh_localport accept
{%- endif +%}
{% endif -%}
ip6 saddr $ansible_controllers_ip6 tcp dport $ssh_localport accept
ip6 daddr $ansible_controllers_ip6 tcp sport $ssh_localport accept
ip saddr $ansible_controllers_ip4 tcp dport $ssh_localport accept
ip daddr $ansible_controllers_ip4 tcp sport $ssh_localport accept
}
}

18
collections/ansible_collections/nullified/infrastructure/roles/security/templates/system/nftables/03-filter.table.j2
View file

@ -3,13 +3,8 @@ table inet filter {
chain input {
type filter hook input priority 0; policy {{ security_firewall_filter_policy_input }};
{% if security_firewall_supervisor_ip -%}
{% if security_firewall_supervisor_has_ip6 -%}
ip6 saddr $ansible_controller_ip tcp dport $ssh_localport accept
{%- else -%}
ip saddr $ansible_controller_ip tcp dport $ssh_localport accept
{%- endif +%}
{% endif -%}
ip6 saddr $ansible_controllers_ip6 tcp dport $ssh_localport accept
ip saddr $ansible_controllers_ip4 tcp dport $ssh_localport accept
iifname "lo" counter accept
ct state related,established counter accept
@ -18,13 +13,8 @@ table inet filter {
chain output {
type filter hook output priority 0; policy {{ security_firewall_filter_policy_output }};
{% if security_firewall_supervisor_ip -%}
{% if security_firewall_supervisor_has_ip6 -%}
ip6 daddr $ansible_controller_ip tcp sport $ssh_localport accept
{%- else -%}
ip daddr $ansible_controller_ip tcp sport $ssh_localport accept
{%- endif +%}
{% endif -%}
ip6 daddr $ansible_controllers_ip6 tcp sport $ssh_localport accept
ip daddr $ansible_controllers_ip4 tcp sport $ssh_localport accept
oifname "lo" counter accept
ct state related,established counter accept