mrwho/Ansible-Roles
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix

Browse source
This commit is contained in:
a.kazantsev 2026-07-10 20:54:32 +03:00
parent ab23542e10
commit c3c9a6d3f6
2 changed files with 86 additions and 96 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

86
playbooks/mrwho/vm03-firewall.yml Normal file
View file

@ -0,0 +1,86 @@
---
- name: Install firewall
hosts: vm03
roles:
- firewall
vars:
###### Firewalld configuration ######
firewall:
# - previous: replaced # flush previous rules
- zone: internal
state: enabled
permanent: true
service:
- ssh
- ntp
- dns
- bgp
- http
- https
source:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- zone: internal
state: disabled
permanent: true
service:
- cockpit
- dhcpv6-client
- mdns
- samba-client
- zone: public
state: enabled
permanent: true
service:
- ssh
- ntp
- dns
- bgp
- http
- https
- zone: public
state: disabled
permanent: true
service:
- cockpit
- dhcpv6-client
- mdns
- samba-client
- zone: public
masquerade: true
state: enabled
permanent: true
# - set_default_zone: internal
# state: enabled
# permanent: true
# - interface: eth1
# zone: internal
# state: enabled
# permanent: true
# - interface: eth2
# zone: internal
# state: enabled
# permanent: true
- interface: eth0
zone: public
state: enabled
permanent: true
# - interface: tun0
# zone: external
# state: enabled
# permanent: true
# - interface: tun1
# zone: external
# state: enabled
# permanent: true

96
playbooks/mrwho/vm03-nginx.yml
View file

@ -3,8 +3,6 @@
hosts: vm03
roles:
- nginx
- firewall
# - chrony
vars:
###### NGINX Configuration ######
@ -77,97 +75,3 @@
locations:
- location: /
target: "http://172.20.21.105:3000"
###### Firewalld configuration ######
firewall:
# - previous: replaced # flush previous rules
- zone: internal
state: enabled
permanent: true
service:
- ssh
- ntp
- dns
- bgp
- http
- https
source:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- zone: internal
state: disabled
permanent: true
service:
- cockpit
- dhcpv6-client
- mdns
- samba-client
- zone: public
state: enabled
permanent: true
service:
- ssh
- ntp
- dns
- bgp
- http
- https
- zone: public
state: disabled
permanent: true
service:
- cockpit
- dhcpv6-client
- mdns
- samba-client
- zone: public
masquerade: true
state: enabled
permanent: true
# - set_default_zone: internal
# state: enabled
# permanent: true
# - interface: eth1
# zone: internal
# state: enabled
# permanent: true
# - interface: eth2
# zone: internal
# state: enabled
# permanent: true
- interface: eth0
zone: public
state: enabled
permanent: true
# - interface: tun0
# zone: external
# state: enabled
# permanent: true
# - interface: tun1
# zone: external
# state: enabled
# permanent: true
###### chrony-client ######
chrony_disable_ntpd: true
chrony_enable: true
chrony_log_enable: true
chrony_log: measurements statistics tracking
chrony_logdir: /var/log/chrony/
chrony_ntp_servers:
- 10.203.2.11
- 10.203.2.12
chrony_rtcsync: true
chrony_timezone: Europe/Moscow