roles/virt-common/tasks/firewall.yml

@@ -4,13 +4,35 @@
 - name: General firewall rules
   notify: Reload firewalld
   block:
-    - name: Move LAN networks to zone 'dmz'
+    - name: Move Guest LAN and and IoT LAN networks to zone 'drop'
       ansible.posix.firewalld:
-        zone: dmz
+        zone: drop
-        source: 192.168.0.0/16
+        source: "{{ item }}"
         permanent: true
         state: enabled
       loop:
+        - 192.168.2.0/24
+        - 192.168.4.0/24
+
+    - name: Move Home LAN and VPN networks to zone 'dmz'
+      ansible.posix.firewalld:
+        zone: dmz
+        source: "{{ item }}"
+        permanent: true
+        state: enabled
+      loop:
+        - 192.168.1.0/24
+        - 192.168.8.0/24
+
+    - name: Move Secure LAN and Lab LAN networks to zone 'public'
+      ansible.posix.firewalld:
+        zone: public
+        source: "{{ item }}"
+        permanent: true
+        state: enabled
+      loop:
+        - 192.168.17.0/24
+        - 192.168.23.0/24
 
     - name: Move internal network to zone 'internal'
       ansible.posix.firewalld:
@@ -19,12 +41,19 @@
         permanent: true
         state: enabled
 
-    - name: Deny incoming connections to SSH port in default zone
+    - name: Default deny incoming connections to SSH port in all zones
       ansible.posix.firewalld:
+        zone: "{{ item }}"
         service: ssh
         permanent: true
         state: disabled
+      loop:
+        - drop
+        # - dmz
+        - public
+        - internal
 
+    # Until sapt-labx-ctl01 is deployed
     - name: Allow incoming connections to SSH port in zone 'dmz'
       ansible.posix.firewalld:
         zone: dmz
@@ -32,6 +61,14 @@
         permanent: true
         state: enabled
 
+    # When sapt-labx-ctl01 is deployed
+    # - name: Allow incoming connections from control machines to SSH port in zone 'public'
+    #   ansible.posix.firewalld:
+    #     zone: public
+    #     service: ssh
+    #     permanent: true
+    #     state: enabled
+
 - name: Firewall rules for database servers
   when: hostname in groups['dbservers']
   notify: Reload firewalld
@@ -47,26 +84,35 @@
   when: hostname in groups['proxyservers']
   notify: Reload firewalld
   block:
-    - name: Allow incoming connections to HTTP port in zone 'dmz'
+    - name: Allow incoming connections to HTTP port in zones 'drop' and 'dmz'
       ansible.posix.firewalld:
-        zone: dmz
+        zone: "{{ item }}"
         service: http
         permanent: true
         state: enabled
+      loop:
+        - drop
+        - dmz
 
-    - name: Allow incoming connections to HTTPS port in zone 'dmz'
+    - name: Allow incoming connections to HTTPS port in zones 'drop' and 'dmz'
       ansible.posix.firewalld:
-        zone: dmz
+        zone: "{{ item }}"
         service: https
         permanent: true
         state: enabled
+      loop:
+        - drop
+        - dmz
 
-    - name: Allow incoming connections to HTTP/3 port in zone 'dmz'
+    - name: Allow incoming connections to HTTP/3 port in zones 'drop' and 'dmz'
       ansible.posix.firewalld:
-        zone: dmz
+        zone: "{{ item }}"
         service: http3
         permanent: true
         state: enabled
+      loop:
+        - drop
+        - dmz
 
 - name: Flush handlers
   ansible.builtin.meta: flush_handlers

roles/virt-common/tasks/main.yml

@@ -1,6 +1,14 @@
 # vim: ft=yaml.ansible
 # code: language=ansible
 ---
+- name: Set hostname
+  ansible.builtin.hostname:
+    name: "{{ hostname }}"
+
+- name: Set timezone
+  community.general.timezone:
+    name: "{{ timezone }}"
+
 - name: Copy hosts file
   ansible.builtin.template:
     src: hosts.j2