WoodSmellParticle/ansible-infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore!: separated galaxy deps and own collections; modified ansible script generation to use two paths for collections

Browse source 
REQUIRES REGENERATING ansible.cfg!
This commit is contained in:
NaeiKinDus 2025-02-23 00:00:00 +00:00
parent 4af69c31ce
commit 888590ed9f
Signed by: WoodSmellParticle
GPG key ID: 8E52ADFF7CA8AE56
188 changed files with 30 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

18
ansible_collections/nullified/infrastructure/roles/security/templates/system/nftables/01-nat.table.j2 Normal file
View file

@ -0,0 +1,18 @@
# Setup
table inet nat {
chain prerouting {
type nat hook prerouting priority -100; policy {{ security_firewall_nat_policy_prerouting }};
}
chain input {
type nat hook input priority 100; policy {{ security_firewall_nat_policy_input }};
}
chain output {
type nat hook output priority -100; policy {{ security_firewall_nat_policy_output }};
}
chain postrouting {
type nat hook postrouting priority 100; policy {{ security_firewall_nat_policy_postrouting }};
}
}

59
ansible_collections/nullified/infrastructure/roles/security/templates/system/nftables/02-mangle.table.j2 Normal file
View file

@ -0,0 +1,59 @@
# Setup
table inet mangle {
chain prerouting {
type filter hook prerouting priority -150; policy {{ security_firewall_mangle_policy_prerouting }};
ip protocol icmp accept
ip frag-off & 0x1fff != 0 counter drop
ct state invalid counter drop
tcp flags & (fin|syn|rst|ack) != syn ct state new counter drop
tcp flags & (fin|syn|rst|psh|ack|urg) == 0x0 counter drop
tcp flags & (fin|syn|rst|psh|ack|urg) == fin|syn|rst|psh|ack|urg counter drop
tcp flags & (fin|syn|rst|psh|ack|urg) == 0x0 counter drop
tcp flags & (fin|syn) == fin|syn counter drop
tcp flags & (syn|rst) == syn|rst counter drop
tcp flags & (fin|rst) == fin|rst counter drop
tcp flags & (fin|ack) == fin counter drop
tcp flags & (ack|urg) == urg counter drop
tcp flags & (fin|ack) == fin counter drop
tcp flags & (psh|ack) == psh counter drop
tcp flags & (fin|syn|rst|psh|ack|urg) == fin|syn|rst|psh|ack|urg counter drop
tcp flags & (fin|syn|rst|psh|ack|urg) == 0x0 counter drop
tcp flags & (fin|syn|rst|psh|ack|urg) == fin|psh|urg counter drop
tcp flags & (fin|syn|rst|psh|ack|urg) == fin|syn|psh|urg counter drop
tcp flags & (fin|syn|rst|psh|ack|urg) == fin|syn|rst|ack|urg counter drop
{% if security_firewall_supervisors_ip6 -%}
ip6 saddr $ansible_controllers_ip6 tcp dport $ssh_localport accept
ip6 daddr $ansible_controllers_ip6 tcp sport $ssh_localport accept
{% endif -%}
ip saddr $ansible_controllers_ip4 tcp dport $ssh_localport accept
ip daddr $ansible_controllers_ip4 tcp sport $ssh_localport accept
{% if security_firewall_mangle_drop_privatenets -%}
ip saddr $private_nets counter drop
{% endif -%}
{% if security_firewall_mangle_drop_reservednets -%}
ip saddr $reserved_nets counter drop
{% endif -%}
iifname != "lo" ip saddr 127.0.0.0/8 counter drop
}
chain output {
type route hook output priority -150; policy {{ security_firewall_mangle_policy_output }};
}
chain forward {
type filter hook forward priority -150; policy {{ security_firewall_mangle_policy_forward }};
}
chain postrouting {
type filter hook postrouting priority -150; policy {{ security_firewall_mangle_policy_postrouting }};
{% if security_firewall_supervisors_ip6 -%}
ip6 saddr $ansible_controllers_ip6 tcp dport $ssh_localport accept
ip6 daddr $ansible_controllers_ip6 tcp sport $ssh_localport accept
{% endif -%}
ip saddr $ansible_controllers_ip4 tcp dport $ssh_localport accept
ip daddr $ansible_controllers_ip4 tcp sport $ssh_localport accept
}
}

39
ansible_collections/nullified/infrastructure/roles/security/templates/system/nftables/03-filter.table.j2 Normal file
View file

@ -0,0 +1,39 @@
# Setup
table inet filter {
chain input {
type filter hook input priority 0; policy {{ security_firewall_filter_policy_input }};
{% if security_firewall_supervisors_ip6 -%}
ip6 saddr $ansible_controllers_ip6 tcp dport $ssh_localport accept
{% endif -%}
ip saddr $ansible_controllers_ip4 tcp dport $ssh_localport accept
iifname "lo" counter accept
ct state related,established counter accept
tcp dport $ssh_localport limit rate 10/hour burst 5 packets counter accept
}
chain output {
type filter hook output priority 0; policy {{ security_firewall_filter_policy_output }};
{% if security_firewall_supervisors_ip6 -%}
ip6 daddr $ansible_controllers_ip6 tcp sport $ssh_localport accept
{% endif -%}
ip daddr $ansible_controllers_ip4 tcp sport $ssh_localport accept
oifname "lo" counter accept
ct state related,established counter accept
tcp sport $ssh_localport counter accept
# Allow DNS queries using UDP, DoT and DoH
{% if security_firewall_dns4_servers -%}
ip daddr $dns_servers meta l4proto { tcp, udp } th dport { 53, 443, 953 } accept
{%- endif +%}
{% if security_firewall_dns6_servers -%}
ip6 daddr $dns_servers6 meta l4proto { tcp, udp } th dport { 53, 443, 953 } accept
{%- endif +%}
}
chain forward {
type filter hook forward priority 0; policy {{ security_firewall_filter_policy_forward }};
}
}