mirror of
https://github.com/hanzo-io/cloud.git
synced 2026-11-02 17:30:47 +00:00
75 lines
1.3 KiB
YAML
75 lines
1.3 KiB
YAML
---
|
|
- name: Install ufw
|
|
package:
|
|
name: ufw
|
|
state: present
|
|
|
|
- name: Reset all firewall rules
|
|
ufw:
|
|
state: reset
|
|
|
|
- name: Allow ssh port 22 from everywhere
|
|
ufw:
|
|
rule: allow
|
|
to_port: ssh
|
|
proto: tcp
|
|
|
|
- name: Allow https from everywhere
|
|
ufw:
|
|
rule: allow
|
|
to_port: https
|
|
proto: tcp
|
|
|
|
- name: Allow http from everywhere
|
|
ufw:
|
|
rule: allow
|
|
to_port: http
|
|
proto: tcp
|
|
when: is_proxy_server | default(false) | bool
|
|
|
|
- name: Allow http from proxy
|
|
ufw:
|
|
rule: allow
|
|
from_ip: '{{ proxy_private_ip | default("any") }}'
|
|
to_port: http
|
|
proto: tcp
|
|
when: is_server | default(false) | bool
|
|
|
|
- name: Allow connections from docker bridge
|
|
ufw:
|
|
rule: allow
|
|
interface: docker0
|
|
direction: in
|
|
when: is_server | default(false) | bool
|
|
|
|
- name: Allow mysql port 3306 connections
|
|
ufw:
|
|
rule: allow
|
|
to_port: mysql
|
|
proto: tcp
|
|
when: is_database_server | default(false) | bool
|
|
|
|
- name: Enable logging
|
|
ufw:
|
|
logging: low
|
|
|
|
- name: Deny incoming by default
|
|
ufw:
|
|
default: deny
|
|
direction: incoming
|
|
|
|
- name: Allow outgoing by default
|
|
ufw:
|
|
default: allow
|
|
direction: outgoing
|
|
|
|
- name: Enable ufw
|
|
ufw:
|
|
state: enabled
|
|
|
|
- name: Ensure ufw systemd service is enabled and running
|
|
service:
|
|
name: ufw
|
|
enabled: yes
|
|
state: started
|