Ruakij/Ansible-roles
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add a host_exporters role for the node and smartctl exporters and a host_firewall scrapers rule that opens exporter ports on wt0 to named source addresses

Browse Source
This commit is contained in:
Ruakij
2026-10-23 20:44:59 +00:00
parent 381e1b285c
commit a64d082c0c
4 changed files with 90 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
host_firewall/defaults/main.yml
+6
View File
@@ -16,6 +16,12 @@ firewall:
admin:
v4: {}
v6: {}
# Metrics scrapers: on wt0 only these source addresses reach the listed tcp
# ports (the vpn zone applies to every peer). Rendered only when both are set.
scrapers:
tcp: {}
v4: {}
v6: {}
# Interface names (nft wildcards allowed) whose traffic is trusted.
internal_ifaces: {}
# Guest bridges (Proxmox vmbr*): DHCP, router solicitations and the public
host_firewall/templates/host.nft.j2
+11
View File
@@ -18,6 +18,7 @@ set {{ name }} {
{% set guest_match = 'iifname { "' ~ (guest_ifaces | join('", "')) ~ '" }' %}
{% set dnat = firewall.dnat | default({}, true) | dict2items | rejectattr('value', 'none') | map(attribute='value') | list %}
{% set masquerade = firewall.masquerade | default({}, true) | dict2items | rejectattr('value', 'none') | map(attribute='value') | unique | list %}
{% set scrapers = firewall.scrapers | default({}, true) %}
{% set forward_guard = firewall.forward_guard | default({}, true) | dict2items | rejectattr('value', 'none') | list %}
# Declare-then-delete makes every load one atomic transaction that replaces
@@ -36,6 +37,8 @@ table inet host {
{{ addr_set('admin_v6', 'ipv6_addr', firewall.admin.v6) }}
{{ addr_set('cluster_v4', 'ipv4_addr', cluster.v4) }}
{{ addr_set('cluster_v6', 'ipv6_addr', cluster.v6) }}
{{ addr_set('scrapers_v4', 'ipv4_addr', scrapers.v4) }}
{{ addr_set('scrapers_v6', 'ipv6_addr', scrapers.v6) }}
set ssh_meter_v4 {
type ipv4_addr; flags dynamic; timeout 10m; size 65535;
}
@@ -85,6 +88,14 @@ table inet host {
}
chain vpn {
{% if list(scrapers.tcp) %}
{% if list(scrapers.v4) %}
ip saddr @scrapers_v4 tcp dport { {{ list(scrapers.tcp) }} } accept
{% endif %}
{% if list(scrapers.v6) %}
ip6 saddr @scrapers_v6 tcp dport { {{ list(scrapers.tcp) }} } accept
{% endif %}
{% endif %}
{% if list(firewall.vpn.tcp) %}
tcp dport { {{ list(firewall.vpn.tcp) }} } accept
{% endif %}