vrrpd: configure minifirewall

This commit is contained in:
Jérémy Lecour 2024-02-06 08:40:55 +01:00 committed by Jérémy Lecour
parent ff233b65a6
commit 12993a8d7c
Signed by: jlecour
SSH Key Fingerprint: SHA256:h+5LgHRKwN9lS0SsdVR5yZPeFlJE4Mt+8UtL4CcP8dY
5 changed files with 59 additions and 4 deletions

View File

@ -33,6 +33,7 @@ The **patch** part changes is incremented if multiple releases happen the same m
* check_free_space: added role
* nagios-nrpe: new check_pressure_{cpu,io,mem}
* generateldif: new Services for check_pressure_{cpu,io,mem}
* vrrpd: configure minifirewall
### Changed

View File

@ -11,4 +11,7 @@ vrrp_addresses: []
# label: Null # use this name is syslog messages (helps when several vrid are running)
# ip: Null # the ip address(es) (and optionnaly subnet mask) of the virtual server
# state: Null # 'started' or 'stopped'
# }
# }
minifirewall_restart_if_needed: True
minifirewall_restart_force: False

15
vrrpd/handlers/main.yml Normal file
View File

@ -0,0 +1,15 @@
---
- name: restart minifirewall
ansible.builtin.command:
cmd: /etc/init.d/minifirewall restart
register: minifirewall_init_restart
failed_when:
- "'starting IPTables rules is now finish : OK' not in minifirewall_init_restart.stdout"
- "'minifirewall started' not in minifirewall_init_restart.stdout"
- name: restart minifirewall (noop)
ansible.builtin.meta: noop
register: minifirewall_init_restart
failed_when: False
changed_when: False

View File

@ -18,5 +18,40 @@
enabled: yes
state: "{{ vrrp_address.state }}"
when:
- vrrp_systemd_unit is changed
- not ansible_check_mode
- vrrp_systemd_unit is changed
- not ansible_check_mode
- name: Check if a recent minifirewall is present
ansible.builtin.stat:
path: /etc/minifirewall.d/
register: _minifirewall_dir
- ansible.builtin.set_fact:
minifirewall_restart_handler_name: "{{ minifirewall_restart_if_needed | bool | ternary('restart minifirewall', 'restart minifirewall (noop)') }}"
- name: VRRP output is authorized in minifirewall
lineinfile:
path: /etc/minifirewall.d/vrrpd
line: "/sbin/iptables -A OUTPUT -o {{ vrrp_address.interface }} -p 112 -j ACCEPT # Allow VRRP output on {{ vrrp_address.interface }}"
regexp: "# Allow VRRP output on {{ vrrp_address.interface }}$"
create: yes
mode: "0600"
owner: "root"
group: "root"
notify: "{{ minifirewall_restart_handler_name }}"
when: _minifirewall_dir.stat.exists
- name: VRRP input is authorized in minifirewall
lineinfile:
path: /etc/minifirewall.d/vrrpd
line: "/sbin/iptables -A INPUT -i {{ vrrp_address.interface }} -s {{ peer }} -d 224.0.0.0/8 -j ACCEPT # Allow VRRP input on {{ vrrp_address.interface }} from {{ peer }} for VRID {{ vrrp_address.id }}"
regexp: "# Allow VRRP input on {{ vrrp_address.interface }} from {{ peer }} for VRID {{ vrrp_address.id }}"
create: yes
mode: "0600"
owner: "root"
group: "root"
loop: "{{ vrrp_address.peers | default([]) }}"
loop_control:
loop_var: peer
notify: "{{ minifirewall_restart_handler_name }}"
when: _minifirewall_dir.stat.exists

View File

@ -1,4 +1,5 @@
---
- name: Install Evolix public repositry
ansible.builtin.include_role:
name: evolix/apt
@ -71,4 +72,4 @@
ansible.builtin.include: ip.yml
loop: "{{ vrrp_addresses }}"
loop_control:
loop_var: "vrrp_address"
loop_var: "vrrp_address"