WoodSmellParticle/ansible-infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(vault): add a HashiCorp Vault role

Browse source
This commit is contained in:
NaeiKinDus 2024-06-26 00:00:00 +00:00
parent 688bdae6a1
commit ddf406fd37
Signed by: WoodSmellParticle
GPG key ID: 8E52ADFF7CA8AE56
17 changed files with 477 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

13
collections/ansible_collections/nullified/infrastructure/roles/vault/templates/vault.nft.j2 Normal file
View file

@ -0,0 +1,13 @@
{%- set api_source_ips = firewall_lb_ips | default({}, True) -%}
{%- set noop = api_source_ips.update(firewall_cluster_nodes_ips) -%}
table inet filter {
chain input {
{% if firewall_lb_ips %}ip saddr { {{ api_source_ips | join (', ') }} } {% endif %}tcp dport {{ hc_vault_api_port }} accept
{% if firewall_cluster_nodes_ips %}ip saddr { {{ firewall_cluster_nodes_ips | join(', ') }} } tcp dport {{ hc_vault_raft_cluster_port }}{% endif +%}
}
chain output {
{% if firewall_lb_ips %}ip daddr { {{ api_source_ips | join (', ') }} } {% endif %}tcp sport {{ hc_vault_api_port }} accept
{% if firewall_cluster_nodes_ips %}ip daddr { {{ firewall_cluster_nodes_ips | join(', ') }} } tcp sport {{ hc_vault_raft_cluster_port }}{% endif +%}
}
}