Commit de93b1e2 authored by nimrod's avatar nimrod
Browse files

Ansible: Open ports in UFW. 

For some reason, accessing the registry in ns4 from the gitlab-runner
Docker network fails unless I open the port. So let's open all of the
ports in all of the hosts and be consistent (and hopefully avoid similar
issues in the future).
parent 684e4f9b

Ansible/hosts/all.yaml

+17 −0
Original line number Diff line number Diff line
@@ -7,14 +7,31 @@ all: 
      ansible_ssh_port: 22

    ns4:

      ansible_host: ns4.shore.co.il

      open_ports:

        - domain/tcp

        - domain/udp

        - http/tcp

        - https/tcp

    kodi:

      ansible_host: kodi.shore.co.il

      open_ports:

        - 51413/tcp

        - 51413/udp

        - http/tcp

        - https/tcp

    mr8300:

      # We already log in as root.

      ansible_become: false

      ansible_host: mr8300.shore.co.il

    host01:

      ansible_host: host01.shore.co.il

      open_ports:

        - 2222/tcp

        - http/tcp

        - https/tcp

        - imaps/tcp

        - smtp/tcp

        - submission/tcp

    localhost:

      ansible_become: false

      ansible_connection: local

Ansible/roles/debian_server/tasks/main.yml

+13 −0
Original line number Diff line number Diff line
@@ -51,11 +51,24 @@ 
    rule: limit

    port: ssh

    proto: tcp

  tags:

    - ufw



- name: Enable UFW

  community.general.ufw:

    default: reject

    state: enabled

  tags:

    - ufw



- name: Open ports

  loop: "{{ open_ports|default([]) }}"

  community.general.ufw:

    rule: allow

    port: "{{ (item|split('/'))[0] }}"

    proto: "{{ (item|split('/'))[1] }}"

  tags:

    - ufw



- name: Allow more inotify watches

  ansible.posix.sysctl: