WoodSmellParticle/ansible-infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(security): find controllers IP from SSH connection, not from hostname lookup

Browse source
This commit is contained in:
NaeiKinDus 2023-12-25 00:00:00 +00:00
parent d65aa3e6cc
commit 3659c15749
Signed by: WoodSmellParticle
GPG key ID: 8E52ADFF7CA8AE56
2 changed files with 13 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
collections/ansible_collections/nullified/infrastructure/roles/security/tasks/firewall.yml
View file

@ -5,6 +5,17 @@
- distribution
- virtualization_type
- name: get supervisor IP address
ansible.builtin.shell: "echo $SSH_CLIENT | tr -s '[:blank:]' ' ' | cut -d ' ' -f 1"
register: ssh_client
changed_when: false
failed_when: ssh_client.stdout is falsy
- name: set fact
ansible.builtin.set_fact:
supervisor_ip: "{{ ssh_client.stdout }}"
changed_when: false
- name: install and configure nftables
when: security.firewall.enable is truthy
become: true
@ -33,9 +44,6 @@
src: "../templates/system/{{ ansible_facts['distribution'] | lower }}/nftables.conf.j2"
dest: /etc/nftables.conf
mode: '0700'
vars:
controller_ip: "{{ lookup('pipe', '/bin/dig +short A $(/usr/bin/hostname -f)') }}"
controller_ip6: "{{ lookup('pipe', '/bin/dig +short AAAA $(/usr/bin/hostname -f)') }}"
- name: common firewall rules
ansible.builtin.template:

4
collections/ansible_collections/nullified/infrastructure/roles/security/templates/system/debian/nftables.conf.j2
View file

@ -2,8 +2,8 @@
flush ruleset
define ansible_controller_ip = {{ controller_ip | default('127.0.0.1', true) }}
define ansible_controller_ip6 = {{ controller_ip6 | default('fe80::', true) }}
define ansible_controller_ip = {{ supervisor_ip | default('127.0.0.1', true) }}
define ansible_controller_ip6 = {{ supervisor_ipp6 | default('fe80::', true) }}
define dns_server = {{ dns_server | default('9.9.9.9', true) }}
define dns_server6 = {{ dns_server | default('2620:fe::fe', true) }}
define private_nets = {