misc/ansible-base
0
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Add ufw role

Browse source 
- Enable ufw and by default deny incoming traffic
- in other roles: if ufw (role) is enabled, then allow necessary ports
This commit is contained in:
Marius Melzer 2024-04-20 17:08:39 +02:00
parent f231fb75b0
commit 65b00c8840
6 changed files with 153 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
roles/lighttpd/tasks/main.json
View file

@ -27,6 +27,32 @@
"dest": "/etc/lighttpd/conf-enabled/10-ssl-custom.conf"
}
},
{
"name": "Check wether enabling UFW would be considered a changed",
"check_mode": true,
"community.general.ufw": {
"state": "enabled",
"register": "ufw_enable_check"
}
},
{
"name": "Allow port 80 in ufw",
"community.general.ufw": {
"rule": "allow",
"port": "80",
"proto": "tcp"
},
"when": "not ufw_enable_check.changed"
},
{
"name": "Allow port 443 in ufw",
"community.general.ufw": {
"rule": "allow",
"port": "443",
"proto": "tcp"
},
"when": "not ufw_enable_check.changed"
},
{
"name": "restart service",
"become": true,

17
roles/murmur/tasks/main.json
View file

@ -25,6 +25,23 @@
"cmd": "murmurd -ini /etc/mumble-server.ini -supw {{var_murmur_admin_password}}"
}
},
{
"name": "Check wether enabling UFW would be considered a changed",
"check_mode": true,
"community.general.ufw": {
"state": "enabled",
"register": "ufw_enable_check"
}
},
{
"name": "Allow port in ufw",
"community.general.ufw": {
"rule": "allow",
"port": "{{ var_murmur_port }}",
"proto": "tcp"
},
"when": "not ufw_enable_check.changed"
},
{
"name": "service",
"become": true,

26
roles/nginx/tasks/main.json
View file

@ -9,6 +9,32 @@
]
}
},
{
"name": "Check wether enabling UFW would be considered a changed",
"check_mode": true,
"community.general.ufw": {
"state": "enabled",
"register": "ufw_enable_check"
}
},
{
"name": "Allow port 80 in ufw",
"community.general.ufw": {
"rule": "allow",
"port": "80",
"proto": "tcp"
},
"when": "not ufw_enable_check.changed"
},
{
"name": "Allow port 443 in ufw",
"community.general.ufw": {
"rule": "allow",
"port": "443",
"proto": "tcp"
},
"when": "not ufw_enable_check.changed"
},
{
"name": "restart service",
"become": true,

26
roles/proftpd/tasks/main.json
View file

@ -8,5 +8,31 @@
"proftpd-core"
]
}
},
{
"name": "Check wether enabling UFW would be considered a changed",
"check_mode": true,
"community.general.ufw": {
"state": "enabled",
"register": "ufw_enable_check"
}
},
{
"name": "Allow FTP port 20 in ufw",
"community.general.ufw": {
"rule": "allow",
"port": "20",
"proto": "tcp"
},
"when": "not ufw_enable_check.changed"
},
{
"name": "Allow FTP port 21 in ufw",
"community.general.ufw": {
"rule": "allow",
"port": "21",
"proto": "tcp"
},
"when": "not ufw_enable_check.changed"
}
]

17
roles/synapse/tasks/main.json
View file

@ -58,6 +58,23 @@
"dest": "/etc/matrix-synapse/homeserver.yaml"
}
},
{
"name": "Check wether enabling UFW would be considered a changed",
"check_mode": true,
"community.general.ufw": {
"state": "enabled",
"register": "ufw_enable_check"
}
},
{
"name": "Allow matrix federation port in ufw",
"community.general.ufw": {
"rule": "allow",
"port": "8448",
"proto": "tcp"
},
"when": "not ufw_enable_check.changed"
},
{
"name": "restart service",
"become": true,

41
roles/ufw/tasks/main.json Normal file
View file

@ -0,0 +1,41 @@
[
{
"name": "install ufw",
"become": true,
"ansible.builtin.apt": {
"update_cache": true,
"pkg": [
"ufw"
]
}
},
{
"name": "ufw deny incoming",
"ufw": {
"direction": "incoming",
"proto": "any",
"policy": "deny"
}
},
{
"name": "ufw allow outgoing",
"ufw": {
"direction": "outgoing",
"proto": "any",
"policy": "allow"
}
},
{
"name": "ufw allow and rate-limit ssh",
"ufw": {
"rule": "limit",
"name": "ssh"
}
},
{
"name": "enable ufw service",
"ufw": {
"state": "enabled"
}
}
]