WoodSmellParticle/ansible-infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

refactor!: switch hosts variables to a flat layout

Browse source
This commit is contained in:
NaeiKinDus 2024-01-21 00:00:00 +00:00
parent f669dea62a
commit 779f2766f2
Signed by: WoodSmellParticle
GPG key ID: 8E52ADFF7CA8AE56
33 changed files with 270 additions and 322 deletions
Download patch file Download diff file Expand all files Collapse all files

15
collections/ansible_collections/nullified/infrastructure/roles/security/templates/system/debian/nftables.conf.j2
View file

@ -2,14 +2,19 @@
flush ruleset
define ansible_controller_ip = {{ supervisor_ip | default('127.0.0.1', true) }}
define ansible_controller_ip6 = {{ supervisor_ip6 | default('fe80::', true) }}
{% if security_firewall_supervisor_ip -%}
define ansible_controller_ip = {{ security_firewall_supervisor_ip }}
{% endif -%}
{% if security_firewall_dns4_servers -%}
define dns_servers = {
{{ dns[dns.type].dns4 | default(["9.9.9.9", "149.112.112.112"], true) | join(", ") | wordwrap(40, wrapstring="\n\t") }}
{{ security_firewall_dns4_servers | join(", ") | wordwrap(40, wrapstring="\n\t") }}
}
{% endif -%}
{% if security_firewall_dns6_servers -%}
define dns_servers6 = {
{{ dns[dns.type].dns6 | default(["2620:fe::fe", "2620:fe::9"], true) | join(", ") | wordwrap(40, wrapstring="\n\t") }}
{{ security_firewall_dns6_servers | join(", ") | wordwrap(40, wrapstring="\n\t") }}
}
{% endif -%}
define private_nets = {
10.0.0.0/8, 100.64.0.0/10, 172.16.0.0/12,
192.0.0.0/24, 192.168.0.0/16, 198.18.0.0/15
@ -19,7 +24,7 @@ define reserved_nets = {
192.88.99.0/24, 198.51.100.0/24, 203.0.113.0/24,
224.0.0.0/4, 233.252.0.0/24, 240.0.0.0/4
}
define ssh_localport = {{ ssh_localport | default(22, true) }}
define ssh_localport = {{ security_ssh_port }}
include "/etc/nftables.d/01-nat.table"
include "/etc/nftables.d/02-mangle.table"

8
collections/ansible_collections/nullified/infrastructure/roles/security/templates/system/nftables/01-nat.table.j2
View file

@ -1,18 +1,18 @@
# Setup
table inet nat {
chain prerouting {
type nat hook prerouting priority -100; policy {{ firewall.nat.policy.prerouting }};
type nat hook prerouting priority -100; policy {{ security_firewall_nat_policy_prerouting }};
}
chain input {
type nat hook input priority 100; policy {{ firewall.nat.policy.input }};
type nat hook input priority 100; policy {{ security_firewall_nat_policy_input }};
}
chain output {
type nat hook output priority -100; policy {{ firewall.nat.policy.output }};
type nat hook output priority -100; policy {{ security_firewall_nat_policy_output }};
}
chain postrouting {
type nat hook postrouting priority 100; policy {{ firewall.nat.policy.postrouting }};
type nat hook postrouting priority 100; policy {{ security_firewall_nat_policy_postrouting }};
}
}

29
collections/ansible_collections/nullified/infrastructure/roles/security/templates/system/nftables/02-mangle.table.j2
View file

@ -1,7 +1,7 @@
# Setup
table inet mangle {
chain prerouting {
type filter hook prerouting priority -150; policy {{ firewall.mangle.policy.prerouting }};
type filter hook prerouting priority -150; policy {{ security_firewall_mangle_policy_prerouting }};
ip protocol icmp accept
ip frag-off & 0x1fff != 0 counter drop
ct state invalid counter drop
@ -22,12 +22,17 @@ table inet mangle {
tcp flags & (fin|syn|rst|psh|ack|urg) == fin|syn|psh|urg counter drop
tcp flags & (fin|syn|rst|psh|ack|urg) == fin|syn|rst|ack|urg counter drop
{% if security_firewall_supervisor_ip -%}
{% if security_firewall_supervisor_has_ip6 -%}
ip6 saddr $ansible_controller_ip tcp dport $ssh_localport accept
ip6 daddr $ansible_controller_ip tcp sport $ssh_localport accept
{% else -%}
ip saddr $ansible_controller_ip tcp dport $ssh_localport accept
ip6 saddr $ansible_controller_ip6 tcp dport $ssh_localport accept
ip daddr $ansible_controller_ip tcp sport $ssh_localport accept
ip6 daddr $ansible_controller_ip6 tcp sport $ssh_localport accept
{%- endif +%}
{% endif -%}
{% if firewall.mangle.drop_privatenets -%}
{% if security_firewall_mangle_drop_privatenets -%}
ip saddr $private_nets counter drop
{% endif -%}
ip saddr $reserved_nets counter drop
@ -35,18 +40,24 @@ table inet mangle {
}
chain output {
type route hook output priority -150; policy {{ firewall.mangle.policy.output }};
type route hook output priority -150; policy {{ security_firewall_mangle_policy_output }};
}
chain forward {
type filter hook forward priority -150; policy {{ firewall.mangle.policy.forward }};
type filter hook forward priority -150; policy {{ security_firewall_mangle_policy_forward }};
}
chain postrouting {
type filter hook postrouting priority -150; policy {{ firewall.mangle.policy.postrouting }};
type filter hook postrouting priority -150; policy {{ security_firewall_mangle_policy_postrouting }};
{% if security_firewall_supervisor_ip -%}
{% if security_firewall_supervisor_has_ip6 -%}
ip6 saddr $ansible_controller_ip tcp dport $ssh_localport accept
ip6 daddr $ansible_controller_ip tcp sport $ssh_localport accept
{%- else -%}
ip saddr $ansible_controller_ip tcp dport $ssh_localport accept
ip6 saddr $ansible_controller_ip6 tcp dport $ssh_localport accept
ip daddr $ansible_controller_ip tcp sport $ssh_localport accept
ip6 daddr $ansible_controller_ip6 tcp sport $ssh_localport accept
{%- endif +%}
{% endif -%}
}
}

25
collections/ansible_collections/nullified/infrastructure/roles/security/templates/system/nftables/03-filter.table.j2
View file

@ -1,9 +1,15 @@
# Setup
table inet filter {
chain input {
type filter hook input priority 0; policy {{ firewall.filter.policy.input }};
type filter hook input priority 0; policy {{ security_firewall_filter_policy_input }};
{% if security_firewall_supervisor_ip -%}
{% if security_firewall_supervisor_has_ip6 -%}
ip6 saddr $ansible_controller_ip tcp dport $ssh_localport accept
{%- else -%}
ip saddr $ansible_controller_ip tcp dport $ssh_localport accept
ip6 saddr $ansible_controller_ip6 tcp dport $ssh_localport accept
{%- endif +%}
{% endif -%}
iifname "lo" counter accept
ct state related,established counter accept
@ -11,20 +17,29 @@ table inet filter {
}
chain output {
type filter hook output priority 0; policy {{ firewall.filter.policy.output }};
type filter hook output priority 0; policy {{ security_firewall_filter_policy_output }};
{% if security_firewall_supervisor_ip -%}
{% if security_firewall_supervisor_has_ip6 -%}
ip6 daddr $ansible_controller_ip tcp sport $ssh_localport accept
{%- else -%}
ip daddr $ansible_controller_ip tcp sport $ssh_localport accept
ip6 daddr $ansible_controller_ip6 tcp sport $ssh_localport accept
{%- endif +%}
{% endif -%}
oifname "lo" counter accept
ct state related,established counter accept
tcp sport $ssh_localport counter accept
# Allow DNS queries using UDP, DoT and DoH
{% if security_firewall_dns4_servers -%}
ip daddr $dns_servers meta l4proto { tcp, udp } th dport { 53, 443, 953 } accept
{%- endif +%}
{% if security_firewall_dns6_servers -%}
ip6 daddr $dns_servers6 meta l4proto { tcp, udp } th dport { 53, 443, 953 } accept
{%- endif +%}
}
chain forward {
type filter hook forward priority 0; policy {{ firewall.filter.policy.forward }};
type filter hook forward priority 0; policy {{ security_firewall_filter_policy_forward }};
}
}