ansible/docker-traefik
Archived
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

YoLo I CAN HAZ PYTHON, I CAN HAZ INDENTS

Browse source
This commit is contained in:
Kekskurse 2021-10-19 19:49:15 +02:00
parent f31fdf57a7
commit 60cef2cc60
Signed by: kekskurse
GPG key ID: 728ACCB59341E7E4
3 changed files with 59 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
handlers/main.yml Normal file
View file

@ -0,0 +1,5 @@
- name: Restart ufw
ansible.builtin.service:
name: ufw
state: restarted
listen: "restart ufw services"

28
tasks/main.yml
View file

@ -5,4 +5,30 @@
include: composer.yml
- name: Install Traefic
include: traefic.yml
include: traefic.yml
#ufw route allow proto tcp from any to any port 80
- name: Allow 80
community.general.ufw:
route: true
rule: allow
proto: tcp
from: any
to: any
to_port: 80
- name: Allow 443
community.general.ufw:
route: true
rule: allow
proto: tcp
from: any
to: any
to_port: 443
- name: Template a file to /etc/ufw/after.rules
ansible.builtin.template:
src: after.rules.j2
dest: /etc/ufw/after.rules
owner: root
group: root
mode: '0640'
notify: "restart ufw services"

27
templates/after.rules.2 Normal file
View file

@ -0,0 +1,27 @@
# BEGIN UFW AND DOCKER
*filter
:ufw-user-forward - [0:0]
:ufw-docker-logging-deny - [0:0]
:DOCKER-USER - [0:0]
-A DOCKER-USER -j ufw-user-forward
-A DOCKER-USER -j RETURN -s 10.0.0.0/8
-A DOCKER-USER -j RETURN -s 172.16.0.0/12
-A DOCKER-USER -j RETURN -s 192.168.0.0/16
-A DOCKER-USER -p udp -m udp --sport 53 --dport 1024:65535 -j RETURN
-A DOCKER-USER -j ufw-docker-logging-deny -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 192.168.0.0/16
-A DOCKER-USER -j ufw-docker-logging-deny -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 10.0.0.0/8
-A DOCKER-USER -j ufw-docker-logging-deny -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 172.16.0.0/12
-A DOCKER-USER -j ufw-docker-logging-deny -p udp -m udp --dport 0:32767 -d 192.168.0.0/16
-A DOCKER-USER -j ufw-docker-logging-deny -p udp -m udp --dport 0:32767 -d 10.0.0.0/8
-A DOCKER-USER -j ufw-docker-logging-deny -p udp -m udp --dport 0:32767 -d 172.16.0.0/12
-A DOCKER-USER -j RETURN
-A ufw-docker-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW DOCKER BLOCK] "
-A ufw-docker-logging-deny -j DROP
COMMIT
# END UFW AND DOCKER