Ruakij/Ansible-roles
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

host_firewall: public_ips of every inventory host are exempt from the rate-limit meters, ArgoCD fetches and mail submission from the cluster nodes hit the web and submission limits

Browse Source
This commit is contained in:
Ruakij
2026-10-26 13:21:20 +00:00
parent c2c8934ec9
commit 589f899bae
2 changed files with 21 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
host_firewall/templates/host.nft.j2
+19 -1
View File
@@ -11,7 +11,19 @@ set {{ name }} {
{% endif %}
}
{%- endmacro %}
{% macro addr_list_set(name, type, items) -%}
set {{ name }} {
type {{ type }}; flags interval; auto-merge;
{% if items %}
elements = { {{ items | join(', ') }} }
{% endif %}
}
{%- endmacro %}
{% set cluster = firewall.cluster | default({}, true) %}
{# public_ips of every inventory host: IPv4 per address, IPv6 per /64 (a longer prefix is widened, nft masks the host bits) #}
{% set public_ips = groups['all'] | map('extract', hostvars, 'public_ips') | select('defined') | flatten | map('string') | unique | list %}
{% set exempt_v4 = public_ips | reject('search', ':') | map('regex_replace', '^([^/]+)$', '\\1/32') | list %}
{% set exempt_v6 = public_ips | select('search', ':') | map('regex_replace', '^([^/]+)$', '\\1/128') | map('regex_replace', '/(6[5-9]|[7-9][0-9]|1[01][0-9]|12[0-8])$', '/64') | list %}
{% set cluster_ifaces = cluster.ifaces | default({}, true) | dict2items | rejectattr('value', 'none') | map(attribute='value') | unique | list %}
{% set internal_ifaces = firewall.internal_ifaces | default({}, true) | dict2items | rejectattr('value', 'none') | map(attribute='value') | unique | list %}
{% set guest_ifaces = firewall.guest_ifaces | default({}, true) | dict2items | rejectattr('value', 'none') | map(attribute='value') | unique | list %}
@@ -76,6 +88,8 @@ table inet host {
{{ addr_set('cluster_v6', 'ipv6_addr', cluster.v6) }}
{{ addr_set('scrapers_v4', 'ipv4_addr', scrapers.v4) }}
{{ addr_set('scrapers_v6', 'ipv6_addr', scrapers.v6) }}
{{ addr_list_set('rl_exempt_v4', 'ipv4_addr', exempt_v4) }}
{{ addr_list_set('rl_exempt_v6', 'ipv6_addr', exempt_v6) }}
{% for svc in rl_services if svc.input or svc.forward %}
set rl_{{ svc.name }}_v4 {
type ipv4_addr; flags dynamic; timeout 10m; size 65535;
@@ -166,7 +180,9 @@ table inet host {
# Per-service limits on new inbound TCP connections (firewall.ratelimit): per source address (IPv4 /32, IPv6 /64) and per
# range (IPv4 /24, IPv6 /48; the per-source rate times range_factor). Admin, cluster, VPN, guest and internal sources
# are exempt. The excess drops with its own log prefix, which CrowdSec reads as a ratelimit event and not as a port scan.
# and the public addresses of all inventory hosts (rl_exempt_v4, rl_exempt_v6) are exempt: cluster nodes reach other hosts
# with their public address (ArgoCD git fetches, mail submission). The public set is checked only here, no other chain
# trusts it. The excess drops with its own log prefix, which CrowdSec reads as a ratelimit event and not as a port scan.
{% macro rl_exempt() %}
iifname "wt0" return
{% for iface in cluster_ifaces + internal_ifaces + guest_ifaces %}
@@ -176,6 +192,8 @@ table inet host {
ip6 saddr @admin_v6 return
ip saddr @cluster_v4 return
ip6 saddr @cluster_v6 return
ip saddr @rl_exempt_v4 return
ip6 saddr @rl_exempt_v6 return
{% endmacro %}
{% for hook, svcs in [('in', rl_input), ('fwd', rl_forward)] if svcs %}
chain ratelimit_{{ hook }} {