kunsi/bundlewrap
1
0
Fork 0
Code Issues 1 Pull requests 2 Releases Activity

modify nodes and bundles for new nftables syntax

Browse source
This commit is contained in:
Franzi 2021-06-03 13:59:15 +02:00
parent ecb67d012b
commit d569b00960
Signed by: kunsi
GPG key ID: 12E3D2136B818350
30 changed files with 172 additions and 126 deletions
Download patch file Download diff file Expand all files Collapse all files

42
nodes/htz/ex42-1048908.py
View file

@ -137,24 +137,6 @@ nodes['htz.ex42-1048908'] = {
'icinga_options': {
'pretty_name': 'kunsmann.eu',
},
'iptables': {
# TODO move to bundles
'custom_rules': [
'iptables_both -A INPUT -p udp --dport 60000:61000 -j ACCEPT', # mosh
'iptables_both -A INPUT -p tcp --dport 9001 -j ACCEPT', # weechat
# libvirt rules. These are also added by libvirt itself,
# but they would be overridden by our own iptables
# management.
'iptables -A INPUT -i virbr0 -p udp --dport 53 -j ACCEPT',
'iptables -A INPUT -i virbr0 -p tcp --dport 53 -j ACCEPT',
'iptables -A INPUT -i virbr0 -p udp --dport 67:68 -j ACCEPT',
'iptables -A INPUT -i virbr0 -p tcp --dport 67:68 -j ACCEPT',
'iptables -A FORWARD -i virbr0 -j ACCEPT',
'iptables -A FORWARD -o virbr0 -j ACCEPT',
'iptables -t nat -A POSTROUTING -o enp0s31f6 -j MASQUERADE',
],
},
'letsencrypt': {
'concat_and_deploy': {
'kunsi-weechat': {
@ -247,6 +229,30 @@ nodes['htz.ex42-1048908'] = {
'@.*:franzi\\\\.business',
},
},
'nftables': {
'rules': {
'input': {
'kunsi-weechat': [
'udp dport { 60000-61000 } accept',
'tcp dport 9001 accept',
],
'libvirt': [
'tcp dport 53 iif virbr0 accept',
'udp dport 53 iif virbr0 accept',
'udp dport { 67, 68 } iif virbr0 accept',
],
},
'forward': {
'libvirt': [
'iif virbr0 accept',
'oif virbr0 accept',
],
},
'nat_postrouting': {
'oif enp0s31f6 masquerade',
},
},
},
'nginx': {
'vhosts': {
# TODO maybe some of this can be moved to a bundle?