westfarn
209b27142c
Sync runner checkout / sync (pull_request) Successful in 7s
Same deploy path as abc_worker: host_apps on adama/starbuck/etc., NPM for wss://. UDP/7881 still forwarded to one upstream host.
56 lines
1.2 KiB
YAML
56 lines
1.2 KiB
YAML
---
|
|
- name: Install ufw
|
|
ansible.builtin.apt:
|
|
name: ufw
|
|
state: present
|
|
|
|
- name: Set UFW default incoming policy to deny
|
|
community.general.ufw:
|
|
direction: incoming
|
|
policy: deny
|
|
|
|
- name: Set UFW default outgoing policy to allow
|
|
community.general.ufw:
|
|
direction: outgoing
|
|
policy: allow
|
|
|
|
- name: Allow SSH from LAN only
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "{{ ufw_ssh_port }}"
|
|
proto: tcp
|
|
from_ip: "{{ ufw_ssh_allowed_network }}"
|
|
|
|
- name: Allow HTTP and HTTPS
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "{{ item }}"
|
|
proto: tcp
|
|
loop: "{{ ufw_allowed_tcp_ports }}"
|
|
|
|
- name: Allow extra TCP ports
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "{{ item }}"
|
|
proto: tcp
|
|
loop: "{{ ufw_extra_tcp_ports | default([]) }}"
|
|
|
|
- name: Allow extra TCP ports from LAN
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "{{ item }}"
|
|
proto: tcp
|
|
from_ip: "{{ ufw_ssh_allowed_network }}"
|
|
loop: "{{ ufw_lan_tcp_ports | default([]) }}"
|
|
|
|
- name: Allow extra UDP ports or ranges
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "{{ item }}"
|
|
proto: udp
|
|
loop: "{{ ufw_extra_udp_ports | default([]) }}"
|
|
|
|
- name: Enable UFW
|
|
community.general.ufw:
|
|
state: enabled
|