From f246600cbb66834c1289bf52cf7bd95cc6428b02 Mon Sep 17 00:00:00 2001 From: clyhtsuriva Date: Sat, 1 Feb 2025 02:12:10 +0100 Subject: Working debian packer template w/ ansible to set up fw rules after reboot --- ansible/roles/common/handlers/main.yml | 6 ++++++ ansible/roles/common/tasks/main.yml | 4 ++++ ansible/roles/common/tasks/ufw.yml | 35 ++++++++++++++++++++++++++++++++++ 3 files changed, 45 insertions(+) create mode 100644 ansible/roles/common/handlers/main.yml create mode 100644 ansible/roles/common/tasks/main.yml create mode 100644 ansible/roles/common/tasks/ufw.yml (limited to 'ansible/roles/common') diff --git a/ansible/roles/common/handlers/main.yml b/ansible/roles/common/handlers/main.yml new file mode 100644 index 0000000..d090d0e --- /dev/null +++ b/ansible/roles/common/handlers/main.yml @@ -0,0 +1,6 @@ +--- +- name: Restart UFW + ansible.builtin.service: + name: ufw + state: restarted +... diff --git a/ansible/roles/common/tasks/main.yml b/ansible/roles/common/tasks/main.yml new file mode 100644 index 0000000..f15e2b7 --- /dev/null +++ b/ansible/roles/common/tasks/main.yml @@ -0,0 +1,4 @@ +--- +- name: Include UFW tasks + include_tasks: ufw.yml +... diff --git a/ansible/roles/common/tasks/ufw.yml b/ansible/roles/common/tasks/ufw.yml new file mode 100644 index 0000000..155579f --- /dev/null +++ b/ansible/roles/common/tasks/ufw.yml @@ -0,0 +1,35 @@ +--- +- name: Ensure UFW is installed + ansible.builtin.apt: + name: ufw + state: present + +- name: Allow SSH + community.general.ufw: + rule: allow + name: OpenSSH + comment: "Allow SSH" + +- name: Allow HTTP + community.general.ufw: + rule: allow + port: 80 + proto: tcp + comment: "Allow HTTP" + +- name: Allow HTTPS + community.general.ufw: + rule: allow + port: 443 + proto: tcp + comment: "Allow HTTPS" + +- name: Enable UFW + community.general.ufw: + state: enabled + +- name: Ensure UFW is enabled on boot + ansible.builtin.systemd: + name: ufw + enabled: true +... -- cgit v1.2.3