ced4568
507ac4c5d3
common/firewall/docker-tls/platform/lab-host/monitoring-agent/backup roles, orchestrated by site.yml with the ordering that matters (firewall/TLS land before the services that depend on them). Ansible Vault for secrets, no new tool introduced for this project's modest secret surface. Explicit dev/staging/production environment separation, no secrets committed (.gitignore covers vault plaintext, TLS keys, Terraform state, *.env). Validated: ansible-playbook --syntax-check clean.
29 lines
1.1 KiB
YAML
29 lines
1.1 KiB
YAML
---
|
|
# Deploys the matching infra/firewall/*.rules file for this host's group and loads it. Same
|
|
# ruleset, same variables as infra/firewall/validate-firewall.sh renders locally — this task
|
|
# just uses Ansible's own templating instead of sed, against the real inventory values.
|
|
|
|
- name: Determine which ruleset applies to this host
|
|
ansible.builtin.set_fact:
|
|
firewall_ruleset_name: "{{ 'rn-platform-01' if inventory_hostname in groups['platform'] else 'rn-lab-host-01' }}"
|
|
|
|
- name: Render firewall ruleset for this host
|
|
ansible.builtin.template:
|
|
src: "{{ role_path }}/../../../firewall/{{ firewall_ruleset_name }}.rules"
|
|
dest: /etc/iptables/rules.v4.rootnode
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
notify: reload firewall
|
|
|
|
- name: Point iptables-persistent at the RootNode ruleset
|
|
ansible.builtin.file:
|
|
src: /etc/iptables/rules.v4.rootnode
|
|
dest: /etc/iptables/rules.v4
|
|
state: link
|
|
force: true
|
|
notify: reload firewall
|
|
|
|
- name: Flush handlers so the firewall is active before later roles assume it
|
|
ansible.builtin.meta: flush_handlers
|