From c3c9a6d3f63393a84780aa388a32eb792399c13b Mon Sep 17 00:00:00 2001 From: "a.kazantsev" Date: Fri, 10 Jul 2026 20:54:32 +0300 Subject: [PATCH] fix --- playbooks/mrwho/vm03-firewall.yml | 86 +++++++++++++++++++++++++++ playbooks/mrwho/vm03-nginx.yml | 96 ------------------------------- 2 files changed, 86 insertions(+), 96 deletions(-) create mode 100644 playbooks/mrwho/vm03-firewall.yml diff --git a/playbooks/mrwho/vm03-firewall.yml b/playbooks/mrwho/vm03-firewall.yml new file mode 100644 index 0000000..87955e1 --- /dev/null +++ b/playbooks/mrwho/vm03-firewall.yml @@ -0,0 +1,86 @@ +--- +- name: Install firewall + hosts: vm03 + roles: + - firewall + + vars: +###### Firewalld configuration ###### + firewall: +# - previous: replaced # flush previous rules + - zone: internal + state: enabled + permanent: true + service: + - ssh + - ntp + - dns + - bgp + - http + - https + source: + - 10.0.0.0/8 + - 172.16.0.0/12 + - 192.168.0.0/16 + + - zone: internal + state: disabled + permanent: true + service: + - cockpit + - dhcpv6-client + - mdns + - samba-client + + - zone: public + state: enabled + permanent: true + service: + - ssh + - ntp + - dns + - bgp + - http + - https + + - zone: public + state: disabled + permanent: true + service: + - cockpit + - dhcpv6-client + - mdns + - samba-client + + - zone: public + masquerade: true + state: enabled + permanent: true +# - set_default_zone: internal +# state: enabled +# permanent: true + +# - interface: eth1 +# zone: internal +# state: enabled +# permanent: true + +# - interface: eth2 +# zone: internal +# state: enabled +# permanent: true + + - interface: eth0 + zone: public + state: enabled + permanent: true + +# - interface: tun0 +# zone: external +# state: enabled +# permanent: true + +# - interface: tun1 +# zone: external +# state: enabled +# permanent: true diff --git a/playbooks/mrwho/vm03-nginx.yml b/playbooks/mrwho/vm03-nginx.yml index 0c04813..ad3a6e8 100644 --- a/playbooks/mrwho/vm03-nginx.yml +++ b/playbooks/mrwho/vm03-nginx.yml @@ -3,8 +3,6 @@ hosts: vm03 roles: - nginx - - firewall -# - chrony vars: ###### NGINX Configuration ###### @@ -77,97 +75,3 @@ locations: - location: / target: "http://172.20.21.105:3000" - -###### Firewalld configuration ###### - firewall: -# - previous: replaced # flush previous rules - - - zone: internal - state: enabled - permanent: true - service: - - ssh - - ntp - - dns - - bgp - - http - - https - source: - - 10.0.0.0/8 - - 172.16.0.0/12 - - 192.168.0.0/16 - - - zone: internal - state: disabled - permanent: true - service: - - cockpit - - dhcpv6-client - - mdns - - samba-client - - - zone: public - state: enabled - permanent: true - service: - - ssh - - ntp - - dns - - bgp - - http - - https - - - zone: public - state: disabled - permanent: true - service: - - cockpit - - dhcpv6-client - - mdns - - samba-client - - - zone: public - masquerade: true - state: enabled - permanent: true -# - set_default_zone: internal -# state: enabled -# permanent: true - -# - interface: eth1 -# zone: internal -# state: enabled -# permanent: true - -# - interface: eth2 -# zone: internal -# state: enabled -# permanent: true - - - interface: eth0 - zone: public - state: enabled - permanent: true - -# - interface: tun0 -# zone: external -# state: enabled -# permanent: true - -# - interface: tun1 -# zone: external -# state: enabled -# permanent: true - - -###### chrony-client ###### - chrony_disable_ntpd: true - chrony_enable: true - chrony_log_enable: true - chrony_log: measurements statistics tracking - chrony_logdir: /var/log/chrony/ - chrony_ntp_servers: - - 10.203.2.11 - - 10.203.2.12 - chrony_rtcsync: true - chrony_timezone: Europe/Moscow