54 lines
1.7 KiB
YAML
54 lines
1.7 KiB
YAML
---
|
|
# crowdsec-firewall-bouncer in nftables mode stores only the network address of
|
|
# a range decision (CIDR scope "Range") in a plain address set. This role keeps
|
|
# the ranges in interval sets of its own table, next to the firewall bouncer,
|
|
# which keeps handling the single addresses.
|
|
- name: Require LAPI settings
|
|
ansible.builtin.assert:
|
|
that:
|
|
- crowdsec.lapi_url | length > 0
|
|
- crowdsec.range_bouncer_api_key | default('') | length > 0
|
|
fail_msg: crowdsec.lapi_url and crowdsec.range_bouncer_api_key must be set
|
|
|
|
- name: Install python3 and nftables
|
|
ansible.builtin.apt:
|
|
name: [python3, nftables]
|
|
state: present
|
|
|
|
- name: Configure the range bouncer
|
|
ansible.builtin.template:
|
|
src: crowdsec-range-bouncer.json.j2
|
|
dest: /etc/crowdsec-range-bouncer.json
|
|
mode: "0600"
|
|
no_log: true
|
|
notify: Run the range bouncer
|
|
|
|
- name: Install the range bouncer
|
|
ansible.builtin.template:
|
|
src: crowdsec-range-bouncer.py.j2
|
|
dest: /usr/local/sbin/crowdsec-range-bouncer
|
|
mode: "0755"
|
|
notify: Run the range bouncer
|
|
|
|
- name: Install the systemd units
|
|
ansible.builtin.copy:
|
|
src: "{{ item }}"
|
|
dest: "/etc/systemd/system/{{ item }}"
|
|
mode: "0644"
|
|
loop: [crowdsec-range-bouncer.service, crowdsec-range-bouncer.timer]
|
|
register: crowdsec_range_bouncer_units
|
|
notify: Run the range bouncer
|
|
|
|
- name: Enable the range bouncer timer
|
|
ansible.builtin.systemd:
|
|
name: crowdsec-range-bouncer.timer
|
|
enabled: true
|
|
state: started
|
|
daemon_reload: "{{ crowdsec_range_bouncer_units is changed }}"
|
|
# Check mode does not install the unit.
|
|
ignore_errors: "{{ ansible_check_mode }}"
|
|
|
|
# The first run has to succeed before the play moves on to the next host.
|
|
- name: Apply the changes now
|
|
ansible.builtin.meta: flush_handlers
|