This commit is contained in:
Mischa ter Smitten 2023-04-19 17:18:48 +02:00
parent a759784c85
commit 6d3247173c
No known key found for this signature in database
GPG Key ID: F87F0926430C47D0
8 changed files with 24 additions and 19 deletions

View File

@ -1,5 +1,5 @@
# handlers file
---
- name: reload ufw
ufw:
community.general.ufw:
state: reloaded

View File

@ -4,6 +4,6 @@
become: true
pre_tasks:
- name: include vars
include_vars: "{{ playbook_dir }}/../../tests/vars/main.yml"
ansible.builtin.include_vars: "{{ playbook_dir }}/../../tests/vars/main.yml"
roles:
- ../../../

View File

@ -1,3 +1,5 @@
# requirements file
---
collections: []
collections:
- name: community.general
- name: ansible.posix

View File

@ -1,7 +1,7 @@
# tasks file
---
- name: configure | create (local facts) directory
file:
ansible.builtin.file:
path: /etc/ansible/facts.d/
state: directory
owner: root
@ -11,7 +11,7 @@
- ufw-configure-facts
- name: configure | update configuration file(s)
template:
ansible.builtin.template:
src: "{{ item.src }}"
dest: "{{ item.dest }}"
owner: root
@ -27,14 +27,14 @@
- ufw-configure-facts
- name: configure | reset
ufw:
community.general.ufw:
state: reset
when: configuration is changed
tags:
- ufw-configure-reset
- name: configure | default (incoming) policy
ufw:
community.general.ufw:
policy: "{{ ufw_default_incoming_policy }}"
direction: incoming
notify: reload ufw
@ -43,7 +43,7 @@
- ufw-configure-default-policy-incoming
- name: configure | default (outgoing) policy
ufw:
community.general.ufw:
policy: "{{ ufw_default_outgoing_policy }}"
direction: outgoing
notify: reload ufw
@ -52,7 +52,7 @@
- ufw-configure-default-policy-outgoing
- name: configure | rules
ufw:
community.general.ufw:
rule: "{{ item.rule }}"
interface: "{{ item.interface | default('') }}"
direction: "{{ item.direction | default('in') }}"
@ -70,7 +70,7 @@
- ufw-configure-rules
- name: configure | logging
ufw:
community.general.ufw:
logging: "{{ ufw_logging }}"
notify: reload ufw
tags:

View File

@ -1,12 +1,12 @@
# tasks file
---
- name: check if conntrack exists
stat:
ansible.builtin.stat:
path: /proc/sys/net/netfilter/nf_conntrack_tcp_be_liberal
register: _nf_conntrack_tcp_be_liberal
- name: fix dropped ssh sessions | configure kernel
sysctl:
ansible.posix.sysctl:
name: net.netfilter.nf_conntrack_tcp_be_liberal
value: '1'
state: present

View File

@ -1,7 +1,7 @@
# tasks file
---
- name: install | dependencies
apt:
ansible.builtin.apt:
name: "{{ ufw_dependencies }}"
state: "{{ apt_install_state | default('latest') }}"
update_cache: true

View File

@ -1,7 +1,7 @@
# tasks file
---
- name: facts | set
set_fact:
ansible.builtin.set_fact:
kernel_version: "{{ ansible_kernel | regex_search('^([0-9]+\\.[0-9]+\\.[0-9]+)') }}"
tags:
- configuration
@ -9,7 +9,8 @@
- ufw-facts
# see https://askubuntu.com/a/1064533/261010, https://www.spinics.net/lists/netfilter-devel/msg55682.html
- include: fix-dropped-ssh-sessions.yml
- name: fix dropped ssh sessions
ansible.builtin.import_tasks: fix-dropped-ssh-sessions.yml
when:
- kernel_version is version('4.14', '>=')
- kernel_version is version('5', '<')
@ -18,20 +19,22 @@
- ufw
- ufw-fix-dropped-ssh-sessions
- include: install.yml
- namne: install
ansible.builtin.import_tasks: install.yml
tags:
- configuration
- ufw
- ufw-install
- include: configure.yml
- name: configure
ansible.builtin.import_tasks: configure.yml
tags:
- configuration
- ufw
- ufw-configure
- name: start and enable service
ufw:
community.general.ufw:
state: enabled
tags:
- configuration

View File

@ -5,6 +5,6 @@
become: true
pre_tasks:
- name: include vars
include_vars: "{{ playbook_dir }}/vars/main.yml"
ansible.builtin.include_vars: "{{ playbook_dir }}/vars/main.yml"
roles:
- ../../