playbook ansible WIP

This commit is contained in:
Paolo Asperti 2023-10-26 23:13:17 +02:00
parent a2083f79d1
commit 37f2b7b130
Signed by: paspo
GPG Key ID: 06D46905D19D5182
6 changed files with 109 additions and 0 deletions

View File

@ -0,0 +1,35 @@
---
- name: FIREWALL rules
template:
src: rules.v4
dest: /etc/iptables/rules.v4
owner: root
group: root
mode: "0644"
become: true
# notify: nfs_reload_exports
- name: FIREWALL rules restore
shell: iptables-restore /etc/iptables/rules.v4
- name: FIREWALL enable IPv4 forward
sysctl:
name: net.ipv4.ip_forward
value: "1"
sysctl_file: /etc/sysctl.d/ipv4_forward.conf
sysctl_set: yes
state: present
reload: yes
ignoreerrors: yes
- name: FIREWALL disable IPv6
sysctl:
name: net.ipv6.conf.all.disable_ipv6
value: "1"
sysctl_file: /etc/sysctl.d/disable_ipv6.conf
sysctl_set: yes
state: present
reload: yes
ignoreerrors: yes

View File

@ -0,0 +1,25 @@
---
- name: ISO script
template:
src: iso/mount-all.sh
dest: /srv/pxe/mount/mount-all.sh
owner: root
group: root
mode: "0755"
become: true
- name: ISO service
template:
src: iso/mount-isos.service
dest: /etc/systemd/system/mount-isos.service
owner: root
group: root
mode: "0644"
become: true
- name: ISO Enable service
service:
name: mount-isos
enabled: yes
become: true

View File

@ -4,3 +4,5 @@
- include: nginx.yml
- include: dns.yml
- include: nfs.yml
- include: firewall.yml
- include: iso.yml

View File

@ -0,0 +1,9 @@
#!/bin/bash
montami() {
B=$(basename $1)
mount "/srv/pxe/iso/$B" "/srv/pxe/mount/$B"
echo "mounted '/srv/pxe/iso/$B' on '/srv/pxe/mount/$B'"
}
export -f montami
find /srv/pxe/mount/ -mindepth 1 -maxdepth 1 -type d -exec bash -c 'montami "$0"' {} \;

View File

@ -0,0 +1,8 @@
[Unit]
Description=Mount ISOs
[Service]
ExecStart=/srv/pxe/mount/mount-all.sh
[Install]
WantedBy=multi-user.target

View File

@ -0,0 +1,30 @@
*filter
:INPUT DROP [2:72]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [8441:830478]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -m state --state NEW -j ACCEPT
-A INPUT ! -i {{ lan_iface }} -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT
-A INPUT -i {{ lan_iface }} -p udp -m state --state NEW -m udp --dport 67 -j ACCEPT
-A INPUT -i {{ lan_iface }} -p udp -m state --state NEW -m udp --dport 69 -j ACCEPT
-A INPUT -i {{ lan_iface }} -p tcp -m state --state NEW -m tcp --dport 111 -j ACCEPT
-A INPUT -i {{ lan_iface }} -p udp -m state --state NEW -m udp --dport 111 -j ACCEPT
-A INPUT -i {{ lan_iface }} -p tcp -m state --state NEW -m tcp --dport 2049 -j ACCEPT
-A INPUT -i {{ lan_iface }} -p udp -m state --state NEW -m udp --dport 2049 -j ACCEPT
-A INPUT -i {{ lan_iface }} -p udp -m state --state NEW -m udp --dport 4047 -j ACCEPT
-A INPUT -i {{ lan_iface }} -p tcp -m state --state NEW -m tcp --dport 4047 -j ACCEPT
-A INPUT -i {{ lan_iface }} -p tcp -m state --state NEW -m tcp --dport 4048 -j ACCEPT
-A INPUT -i {{ lan_iface }} -p udp -m state --state NEW -m udp --dport 4048 -j ACCEPT
-A FORWARD -i {{ lan_iface }} -o {{ lan_iface }} -j REJECT --reject-with icmp-port-unreachable
COMMIT
*nat
:PREROUTING ACCEPT [72:10770]
:INPUT ACCEPT [68:10030]
:OUTPUT ACCEPT [39:2999]
:POSTROUTING ACCEPT [1:84]
-A POSTROUTING -o {{ wan_iface }} -j MASQUERADE
COMMIT