vrrpd: configure minifirewall

CHANGELOG.md

@@ -33,6 +33,7 @@ The **patch** part changes is incremented if multiple releases happen the same m
 * check_free_space: added role
 * nagios-nrpe: new check_pressure_{cpu,io,mem}
 * generateldif: new Services for check_pressure_{cpu,io,mem}
+* vrrpd: configure minifirewall
 
 ### Changed
 

vrrpd/defaults/main.yml

@@ -11,4 +11,7 @@ vrrp_addresses: []
 #     label: Null             # use this name is syslog messages (helps when several vrid are running)
 #     ip: Null                # the ip address(es) (and optionnaly subnet mask) of the virtual server
 #     state: Null             # 'started' or 'stopped'
-#   }
+#   }
+
+minifirewall_restart_if_needed: True
+minifirewall_restart_force: False

vrrpd/handlers/main.yml

@@ -0,0 +1,15 @@
+---
+
+- name: restart minifirewall
+  ansible.builtin.command:
+    cmd: /etc/init.d/minifirewall restart
+  register: minifirewall_init_restart
+  failed_when:
+    - "'starting IPTables rules is now finish : OK' not in minifirewall_init_restart.stdout"
+    - "'minifirewall started' not in minifirewall_init_restart.stdout"
+
+- name: restart minifirewall (noop)
+  ansible.builtin.meta: noop
+  register: minifirewall_init_restart
+  failed_when: False
+  changed_when: False

vrrpd/tasks/ip.yml

@@ -18,5 +18,40 @@
     enabled: yes
     state: "{{ vrrp_address.state }}"
   when:
-  - vrrp_systemd_unit is changed
-  - not ansible_check_mode
+    - vrrp_systemd_unit is changed
+    - not ansible_check_mode
+
+- name: Check if a recent minifirewall is present
+  ansible.builtin.stat:
+    path: /etc/minifirewall.d/
+  register: _minifirewall_dir
+
+- ansible.builtin.set_fact:
+    minifirewall_restart_handler_name: "{{ minifirewall_restart_if_needed | bool | ternary('restart minifirewall', 'restart minifirewall (noop)') }}"
+
+- name: VRRP output is authorized in minifirewall
+  lineinfile:
+    path: /etc/minifirewall.d/vrrpd
+    line: "/sbin/iptables -A OUTPUT -o {{ vrrp_address.interface }} -p 112 -j ACCEPT # Allow VRRP output on {{ vrrp_address.interface }}"
+    regexp: "# Allow VRRP output on {{ vrrp_address.interface }}$"
+    create: yes
+    mode: "0600"
+    owner: "root"
+    group: "root"
+  notify: "{{ minifirewall_restart_handler_name }}"
+  when: _minifirewall_dir.stat.exists
+
+- name: VRRP input is authorized in minifirewall
+  lineinfile:
+    path: /etc/minifirewall.d/vrrpd
+    line: "/sbin/iptables -A INPUT -i {{ vrrp_address.interface }} -s {{ peer }} -d 224.0.0.0/8 -j ACCEPT # Allow VRRP input on {{ vrrp_address.interface }} from {{ peer }} for VRID {{ vrrp_address.id }}"
+    regexp: "# Allow VRRP input on {{ vrrp_address.interface }} from {{ peer }} for VRID {{ vrrp_address.id }}"
+    create: yes
+    mode: "0600"
+    owner: "root"
+    group: "root"
+  loop: "{{ vrrp_address.peers | default([]) }}"
+  loop_control:
+    loop_var: peer
+  notify: "{{ minifirewall_restart_handler_name }}"
+  when: _minifirewall_dir.stat.exists

vrrpd/tasks/main.yml

@@ -1,4 +1,5 @@
 ---
+
 - name: Install Evolix public repositry
   ansible.builtin.include_role:
     name: evolix/apt
@@ -71,4 +72,4 @@
   ansible.builtin.include: ip.yml
   loop: "{{ vrrp_addresses }}"
   loop_control:
-    loop_var: "vrrp_address"
+    loop_var: "vrrp_address"