mirror of
https://github.com/CivMC/Civ.git
synced 2026-07-18 00:20:44 +00:00
54 lines
1.2 KiB
YAML
54 lines
1.2 KiB
YAML
- name: Allow SSH From anywhere
|
|
ufw:
|
|
rule: allow
|
|
name: OpenSSH
|
|
|
|
# Docker bypasses UFW and modifies iptables directly
|
|
- name: Protect port 3100 for Loki
|
|
iptables:
|
|
chain: DOCKER-USER
|
|
in_interface: ens18 # TODO: Make interface configurable for others
|
|
destination_port: 3100
|
|
protocol: tcp
|
|
jump: REJECT
|
|
|
|
# TODO: Nodes in swarm
|
|
#- name: Allow Docker-machine communication from trusted
|
|
# ufw:
|
|
# rule: allow
|
|
# port: 2376
|
|
# src: '{{ item }}'
|
|
# loop: '{{ trusted_ips }}'
|
|
|
|
#- name: Allow Swarm Manager communication from trusted
|
|
# ufw:
|
|
# rule: allow
|
|
# port: 2377
|
|
# src: '{{ item }}'
|
|
# loop: '{{ trusted_ips }}'
|
|
#
|
|
#- name: Allow Swarm Manager communication from trusted
|
|
# ufw:
|
|
# rule: allow
|
|
# port: 2377
|
|
# src: '{{ item }}'
|
|
# loop: '{{ trusted_ips }}'
|
|
#
|
|
#- name: Allow Container network communication from trusted
|
|
# ufw:
|
|
# rule: allow
|
|
# port: 7946
|
|
# src: '{{ item }}'
|
|
# loop: '{{ trusted_ips }}'
|
|
#
|
|
#- name: Allow Ingress network communication from trusted
|
|
# ufw:
|
|
# rule: allow
|
|
# port: 4789
|
|
# src: '{{ item }}'
|
|
# loop: '{{ trusted_ips }}'
|
|
|
|
- name: Disallow everything else and enable UFW
|
|
ufw:
|
|
state: enabled
|
|
policy: reject |