kris
a1ef6e76a5
- Front git-over-SSH with host sshd and live key lookup - Build and load custom SELinux policies oci_log and gitea_ssh
60 lines
1.5 KiB
YAML
60 lines
1.5 KiB
YAML
- name: Install the Uncomplicated Firewall
|
|
ansible.builtin.apt:
|
|
name: ufw
|
|
state: present
|
|
|
|
- name: Install Fail2ban
|
|
ansible.builtin.apt:
|
|
name: fail2ban
|
|
state: present
|
|
|
|
- name: Ensure Fail2ban's log file is correctly labelled
|
|
ansible.builtin.file:
|
|
path: /var/log/fail2ban.log
|
|
state: touch
|
|
mode: "0640"
|
|
access_time: preserve
|
|
modification_time: preserve
|
|
setype: fail2ban_log_t
|
|
when: selinux is defined and selinux is not false
|
|
notify: restart_fail2ban
|
|
|
|
- name: Deny incoming traffic by default
|
|
community.general.ufw:
|
|
default: deny
|
|
direction: incoming
|
|
|
|
- name: Allow outgoing traffic by default
|
|
community.general.ufw:
|
|
default: allow
|
|
direction: outgoing
|
|
|
|
- name: "{{ base_ssh_ufw_rule | capitalize }} OpenSSH"
|
|
community.general.ufw:
|
|
name: ssh
|
|
rule: "{{ base_ssh_ufw_rule | default('limit') }}"
|
|
|
|
- name: Remove Fail2ban defaults-debian.conf
|
|
ansible.builtin.file:
|
|
path: /etc/fail2ban/jail.d/defaults-debian.conf
|
|
state: absent
|
|
|
|
- name: Install OpenSSH's Fail2ban jail
|
|
ansible.builtin.template:
|
|
src: fail2ban-ssh.conf.j2
|
|
dest: /etc/fail2ban/jail.d/sshd.conf
|
|
mode: "640"
|
|
notify: restart_fail2ban
|
|
|
|
- name: Install Fail2ban IP allow list
|
|
ansible.builtin.template:
|
|
src: fail2ban-allowlist.conf.j2
|
|
dest: /etc/fail2ban/jail.d/allowlist.conf
|
|
mode: "640"
|
|
when: fail2ban_ignoreip is defined
|
|
notify: restart_fail2ban
|
|
|
|
- name: Enable firewall
|
|
community.general.ufw:
|
|
state: enabled
|