Ruakij/Ansible-roles
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

host_firewall: drop inbound traffic from internet-wide scanners (OpenFilters internet-scanners), v4 and v6, daily refresh

Browse Source
This commit is contained in:
Ruakij
2026-10-25 12:12:27 +00:00
parent 38d1ac6ced
commit c50c32059e
7 changed files with 309 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
host_firewall/templates/nft-host-scanners.allowlist.j2
+11
View File
@@ -0,0 +1,11 @@
# {{ ansible_managed }}
{% set maps = [
(crowdsec | default({}, true)).whitelist | default({}, true),
firewall.admin.v4 | default({}, true), firewall.admin.v6 | default({}, true),
firewall.scrapers.v4 | default({}, true), firewall.scrapers.v6 | default({}, true),
firewall.cluster.v4 | default({}, true), firewall.cluster.v6 | default({}, true)] %}
{% set entries = (maps | map('dict2items') | sum(start=[]) | rejectattr('value', 'none') | map(attribute='value') | map('string') | list
+ groups['all'] | map('extract', hostvars, 'public_ips') | select('defined') | flatten) | unique %}
{% for entry in entries %}
{{ entry }}
{% endfor %}