Compare commits
2 Commits
0c0cad9084
...
2bb018a40c
Author | SHA1 | Date | |
---|---|---|---|
2bb018a40c
|
|||
89a1e11b7a
|
@@ -1,10 +1,28 @@
|
||||
---
|
||||
- name: Configure firewall
|
||||
when: ansible_distribution == 'Debian'
|
||||
ansible.builtin.include_tasks:
|
||||
file: firewall_Debian.yml
|
||||
apply:
|
||||
tags:
|
||||
- firewall
|
||||
tags: firewall
|
||||
# Debian 11+ will use nftables directly, with no firewalld.
|
||||
|
||||
- name: Install Debian firewall packages
|
||||
when: ansible_distribution_major_version is version('11', '>=')
|
||||
ansible.builtin.package:
|
||||
name:
|
||||
- libnet-ip-perl # for aggregate-cidr-addresses.pl
|
||||
- nftables
|
||||
- curl # for nftables update scripts
|
||||
state: present
|
||||
cache_valid_time: 3600
|
||||
|
||||
- name: Remove iptables on newer Debian
|
||||
when: ansible_distribution_major_version is version('11', '>=')
|
||||
ansible.builtin.apt:
|
||||
pkg: iptables
|
||||
state: absent
|
||||
|
||||
- name: Configure nftables
|
||||
ansible.builtin.include_tasks: nftables.yml
|
||||
when: ansible_distribution_version is version('11', '>=')
|
||||
|
||||
- ansible.builtin.include_tasks: fail2ban.yml
|
||||
when:
|
||||
- ansible_distribution_major_version is version('9', '>=')
|
||||
|
||||
# vim: set sw=2 ts=2:
|
||||
|
@@ -1,28 +0,0 @@
|
||||
---
|
||||
# Debian 11+ will use nftables directly, with no firewalld.
|
||||
|
||||
- name: Install Debian firewall packages
|
||||
when: ansible_distribution_major_version is version('11', '>=')
|
||||
ansible.builtin.package:
|
||||
name:
|
||||
- libnet-ip-perl # for aggregate-cidr-addresses.pl
|
||||
- nftables
|
||||
- curl # for nftables update scripts
|
||||
state: present
|
||||
cache_valid_time: 3600
|
||||
|
||||
- name: Remove iptables on newer Debian
|
||||
when: ansible_distribution_major_version is version('11', '>=')
|
||||
ansible.builtin.apt:
|
||||
pkg: iptables
|
||||
state: absent
|
||||
|
||||
- name: Configure nftables
|
||||
ansible.builtin.include_tasks: nftables.yml
|
||||
when: ansible_distribution_version is version('11', '>=')
|
||||
|
||||
- ansible.builtin.include_tasks: fail2ban.yml
|
||||
when:
|
||||
- ansible_distribution_major_version is version('9', '>=')
|
||||
|
||||
# vim: set sw=2 ts=2:
|
@@ -8,8 +8,7 @@
|
||||
tags: ntp
|
||||
|
||||
- name: Install common packages
|
||||
ansible.builtin.include_tasks: packages_Debian.yml
|
||||
when: ansible_distribution == 'Debian'
|
||||
ansible.builtin.include_tasks: packages.yml
|
||||
tags: packages
|
||||
|
||||
- name: Configure firewall
|
||||
@@ -23,13 +22,23 @@
|
||||
# containers identify as virtualization hosts, which makes this tricky, because we have actual Debian VM hosts!
|
||||
- name: Reconfigure /etc/sysctl.conf
|
||||
when: ansible_virtualization_role != 'host'
|
||||
ansible.builtin.template: src=sysctl_{{ ansible_distribution }}.j2 dest=/etc/sysctl.conf owner=root group=root mode=0644
|
||||
ansible.builtin.template:
|
||||
src: "sysctl_{{ ansible_distribution }}.j2"
|
||||
dest: /etc/sysctl.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
notify:
|
||||
- reload sysctl
|
||||
tags: sysctl
|
||||
|
||||
- name: Set I/O scheduler
|
||||
ansible.builtin.template: src=etc/udev/rules.d/60-scheduler.rules.j2 dest=/etc/udev/rules.d/60-scheduler.rules owner=root group=root mode=0644
|
||||
ansible.builtin.template:
|
||||
src: etc/udev/rules.d/60-scheduler.rules.j2
|
||||
dest: /etc/udev/rules.d/60-scheduler.rules
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
tags: udev
|
||||
|
||||
- name: Copy admin SSH keys
|
||||
|
Reference in New Issue
Block a user