vrrpd: configure minifirewall
This commit is contained in:
parent
ff233b65a6
commit
12993a8d7c
|
@ -33,6 +33,7 @@ The **patch** part changes is incremented if multiple releases happen the same m
|
||||||
* check_free_space: added role
|
* check_free_space: added role
|
||||||
* nagios-nrpe: new check_pressure_{cpu,io,mem}
|
* nagios-nrpe: new check_pressure_{cpu,io,mem}
|
||||||
* generateldif: new Services for check_pressure_{cpu,io,mem}
|
* generateldif: new Services for check_pressure_{cpu,io,mem}
|
||||||
|
* vrrpd: configure minifirewall
|
||||||
|
|
||||||
### Changed
|
### Changed
|
||||||
|
|
||||||
|
|
|
@ -11,4 +11,7 @@ vrrp_addresses: []
|
||||||
# label: Null # use this name is syslog messages (helps when several vrid are running)
|
# label: Null # use this name is syslog messages (helps when several vrid are running)
|
||||||
# ip: Null # the ip address(es) (and optionnaly subnet mask) of the virtual server
|
# ip: Null # the ip address(es) (and optionnaly subnet mask) of the virtual server
|
||||||
# state: Null # 'started' or 'stopped'
|
# state: Null # 'started' or 'stopped'
|
||||||
# }
|
# }
|
||||||
|
|
||||||
|
minifirewall_restart_if_needed: True
|
||||||
|
minifirewall_restart_force: False
|
||||||
|
|
15
vrrpd/handlers/main.yml
Normal file
15
vrrpd/handlers/main.yml
Normal file
|
@ -0,0 +1,15 @@
|
||||||
|
---
|
||||||
|
|
||||||
|
- name: restart minifirewall
|
||||||
|
ansible.builtin.command:
|
||||||
|
cmd: /etc/init.d/minifirewall restart
|
||||||
|
register: minifirewall_init_restart
|
||||||
|
failed_when:
|
||||||
|
- "'starting IPTables rules is now finish : OK' not in minifirewall_init_restart.stdout"
|
||||||
|
- "'minifirewall started' not in minifirewall_init_restart.stdout"
|
||||||
|
|
||||||
|
- name: restart minifirewall (noop)
|
||||||
|
ansible.builtin.meta: noop
|
||||||
|
register: minifirewall_init_restart
|
||||||
|
failed_when: False
|
||||||
|
changed_when: False
|
|
@ -18,5 +18,40 @@
|
||||||
enabled: yes
|
enabled: yes
|
||||||
state: "{{ vrrp_address.state }}"
|
state: "{{ vrrp_address.state }}"
|
||||||
when:
|
when:
|
||||||
- vrrp_systemd_unit is changed
|
- vrrp_systemd_unit is changed
|
||||||
- not ansible_check_mode
|
- not ansible_check_mode
|
||||||
|
|
||||||
|
- name: Check if a recent minifirewall is present
|
||||||
|
ansible.builtin.stat:
|
||||||
|
path: /etc/minifirewall.d/
|
||||||
|
register: _minifirewall_dir
|
||||||
|
|
||||||
|
- ansible.builtin.set_fact:
|
||||||
|
minifirewall_restart_handler_name: "{{ minifirewall_restart_if_needed | bool | ternary('restart minifirewall', 'restart minifirewall (noop)') }}"
|
||||||
|
|
||||||
|
- name: VRRP output is authorized in minifirewall
|
||||||
|
lineinfile:
|
||||||
|
path: /etc/minifirewall.d/vrrpd
|
||||||
|
line: "/sbin/iptables -A OUTPUT -o {{ vrrp_address.interface }} -p 112 -j ACCEPT # Allow VRRP output on {{ vrrp_address.interface }}"
|
||||||
|
regexp: "# Allow VRRP output on {{ vrrp_address.interface }}$"
|
||||||
|
create: yes
|
||||||
|
mode: "0600"
|
||||||
|
owner: "root"
|
||||||
|
group: "root"
|
||||||
|
notify: "{{ minifirewall_restart_handler_name }}"
|
||||||
|
when: _minifirewall_dir.stat.exists
|
||||||
|
|
||||||
|
- name: VRRP input is authorized in minifirewall
|
||||||
|
lineinfile:
|
||||||
|
path: /etc/minifirewall.d/vrrpd
|
||||||
|
line: "/sbin/iptables -A INPUT -i {{ vrrp_address.interface }} -s {{ peer }} -d 224.0.0.0/8 -j ACCEPT # Allow VRRP input on {{ vrrp_address.interface }} from {{ peer }} for VRID {{ vrrp_address.id }}"
|
||||||
|
regexp: "# Allow VRRP input on {{ vrrp_address.interface }} from {{ peer }} for VRID {{ vrrp_address.id }}"
|
||||||
|
create: yes
|
||||||
|
mode: "0600"
|
||||||
|
owner: "root"
|
||||||
|
group: "root"
|
||||||
|
loop: "{{ vrrp_address.peers | default([]) }}"
|
||||||
|
loop_control:
|
||||||
|
loop_var: peer
|
||||||
|
notify: "{{ minifirewall_restart_handler_name }}"
|
||||||
|
when: _minifirewall_dir.stat.exists
|
||||||
|
|
|
@ -1,4 +1,5 @@
|
||||||
---
|
---
|
||||||
|
|
||||||
- name: Install Evolix public repositry
|
- name: Install Evolix public repositry
|
||||||
ansible.builtin.include_role:
|
ansible.builtin.include_role:
|
||||||
name: evolix/apt
|
name: evolix/apt
|
||||||
|
@ -71,4 +72,4 @@
|
||||||
ansible.builtin.include: ip.yml
|
ansible.builtin.include: ip.yml
|
||||||
loop: "{{ vrrp_addresses }}"
|
loop: "{{ vrrp_addresses }}"
|
||||||
loop_control:
|
loop_control:
|
||||||
loop_var: "vrrp_address"
|
loop_var: "vrrp_address"
|
||||||
|
|
Loading…
Reference in a new issue