72 lines
1.9 KiB
YAML
72 lines
1.9 KiB
YAML
|
---
|
||
|
|
- name: Install UFW
|
||
|
|
ansible.builtin.apt:
|
||
|
|
name: ufw
|
||
|
|
state: present
|
||
|
|
tags: [firewall, ufw]
|
||
|
|
|
||
|
|
- name: Set UFW default policies
|
||
|
|
community.general.ufw:
|
||
|
|
direction: "{{ item.direction }}"
|
||
|
|
policy: "{{ item.policy }}"
|
||
|
|
loop:
|
||
|
|
- { direction: incoming, policy: "{{ ufw_default_incoming }}" }
|
||
|
|
- { direction: outgoing, policy: "{{ ufw_default_outgoing }}" }
|
||
|
|
tags: [firewall, ufw]
|
||
|
|
|
||
|
|
- name: Allow OpenSSH (rate-limited) from LAN
|
||
|
|
community.general.ufw:
|
||
|
|
rule: limit
|
||
|
|
port: "22"
|
||
|
|
proto: tcp
|
||
|
|
src: "{{ lan_subnet }}"
|
||
|
|
comment: "SSH from LAN"
|
||
|
|
tags: [firewall, ufw]
|
||
|
|
|
||
|
|
- name: Allow OpenSSH from anywhere (optional)
|
||
|
|
community.general.ufw:
|
||
|
|
rule: limit
|
||
|
|
port: "22"
|
||
|
|
proto: tcp
|
||
|
|
comment: "SSH world"
|
||
|
|
when: ufw_allow_ssh_from_anywhere | bool
|
||
|
|
tags: [firewall, ufw]
|
||
|
|
|
||
|
|
- name: Allow stack service ports from LAN
|
||
|
|
community.general.ufw:
|
||
|
|
rule: allow
|
||
|
|
port: "{{ item.port | string }}"
|
||
|
|
proto: tcp
|
||
|
|
src: "{{ lan_subnet }}"
|
||
|
|
comment: "{{ item.comment }}"
|
||
|
|
loop: "{{ ufw_lan_tcp_ports }}"
|
||
|
|
# SSH already handled above with limit; skip duplicate 22 if listed
|
||
|
|
when: item.port | int != 22
|
||
|
|
tags: [firewall, ufw]
|
||
|
|
|
||
|
|
- name: Allow Docker published ports on loopback freely (implicit)
|
||
|
|
ansible.builtin.debug:
|
||
|
|
msg: "UFW will leave local/docker internal traffic alone; LAN rules cover published WebUIs."
|
||
|
|
tags: [firewall, ufw]
|
||
|
|
|
||
|
|
# Docker + UFW: without this, published ports can bypass UFW on some setups.
|
||
|
|
# Route forwarded packets through ufw-before-forward is complex; we rely on
|
||
|
|
# binding services to LAN + ufw allow from lan_subnet. Documented in README.
|
||
|
|
|
||
|
|
- name: Enable UFW
|
||
|
|
community.general.ufw:
|
||
|
|
state: enabled
|
||
|
|
when: ufw_enabled | bool
|
||
|
|
tags: [firewall, ufw]
|
||
|
|
|
||
|
|
- name: Show UFW status
|
||
|
|
ansible.builtin.command: ufw status verbose
|
||
|
|
register: ufw_status
|
||
|
|
changed_when: false
|
||
|
|
tags: [firewall, ufw]
|
||
|
|
|
||
|
|
- name: Print UFW status
|
||
|
|
ansible.builtin.debug:
|
||
|
|
msg: "{{ ufw_status.stdout_lines }}"
|
||
|
|
tags: [firewall, ufw]
|