forked from data.coop/ansible
Merge pull request 'Firewall (UFW)' (#107) from samsapti/ansible:main into main
Reviewed-on: data.coop/ansible#107
This commit is contained in:
commit
d53c6d41dc
|
@ -2,6 +2,11 @@
|
|||
|
||||
BASE_CMD="ansible-playbook playbook.yml --ask-vault-pass"
|
||||
|
||||
if [ -z "$(ansible-galaxy collection list community.general 2>/dev/null)" ]; then
|
||||
echo "Installing community modules"
|
||||
ansible-galaxy collection install community.general
|
||||
fi
|
||||
|
||||
if [ -z "$1" ]; then
|
||||
echo "Deploying all!"
|
||||
$BASE_CMD
|
||||
|
|
|
@ -9,6 +9,7 @@
|
|||
- apparmor
|
||||
- haveged
|
||||
- mosh
|
||||
- ufw
|
||||
- srvadmin-all # Dell OpenManage
|
||||
|
||||
- name: Install necessary packages via pip
|
||||
|
|
20
roles/ubuntu_base/tasks/firewall.yml
Normal file
20
roles/ubuntu_base/tasks/firewall.yml
Normal file
|
@ -0,0 +1,20 @@
|
|||
---
|
||||
- name: Setup firewall with UFW
|
||||
community.general.ufw:
|
||||
state: enabled
|
||||
policy: deny
|
||||
- name: Allow necessary ports
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
port: "{{ item }}"
|
||||
loop:
|
||||
- "22/tcp" # Gitea SSH
|
||||
- "80/tcp" # HTTP
|
||||
- "443/tcp" # HTTPS
|
||||
- "389/tcp" # OpenLDAP
|
||||
- "636/tcp" # OpenLDAP
|
||||
- "25/tcp" # Email
|
||||
- "465/tcp" # Email
|
||||
- "587/tcp" # Email
|
||||
- "993/tcp" # Email
|
||||
- "19022/tcp" # SSH
|
|
@ -7,4 +7,6 @@
|
|||
tags: [install-base-packages]
|
||||
- import_tasks: users.yml
|
||||
tags: [setup-users]
|
||||
- import_tasks: firewall.yml
|
||||
tags: [setup-firewall]
|
||||
|
||||
|
|
Loading…
Reference in a new issue