Infrastructure/ansible
1
0
Fork 0
Code Issues Pull requests 6 Projects Releases Packages Wiki Activity Actions

[repospanner] put in firewall rules for systems

Browse source
This commit is contained in:
Stephen Smoogen 2019-03-25 21:30:48 +00:00
parent 2df3d206dd
commit 08e425bf7d
2 changed files with 18 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

12
inventory/group_vars/repospanner
View file

@ -10,4 +10,14 @@ csi_security_category: High
csi_primary_contact: admin@fedoraproject.org / sysadmin-main-members csi_primary_contact: admin@fedoraproject.org / sysadmin-main-members
csi_purpose: repospanner git syncing host csi_purpose: repospanner git syncing host
tcp_ports: [ 8443, 8444] custom_rules: [ '-A INPUT -p tcp -m tcp -s 8.43.84.211 --dport 8443:8445 -j ACCEPT',
'-A INPUT -p tcp -m tcp -s 8.43.84.212 --dport 8443:8445 -j ACCEPT',
'-A INPUT -p tcp -m tcp -s 8.43.85.76 --dport 8443:8445 -j ACCEPT',
'-A INPUT -p tcp -m tcp -s 140.211.169.210 --dport 8443:8445 -j ACCEPT',
'-A INPUT -p tcp -m tcp -s 209.132.181.20 --dport 8443:8445 -j ACCEPT',
'-A INPUT -p tcp -m tcp -s 192.168.1.180 --dport 8443:8445 -j ACCEPT',
'-A INPUT -p tcp -m tcp -s 192.168.1.184 --dport 8443:8445 -j ACCEPT',
'-A INPUT -p tcp -m tcp -s 192.168.1.185 --dport 8443:8445 -j ACCEPT',
'-A INPUT -p tcp -m tcp -s 10.5.126.23 --dport 8443:8445 -j ACCEPT']
## End of file

8
playbooks/groups/repospanner.yml
View file

@ -21,6 +21,9 @@
- collectd/base - collectd/base
- sudo - sudo
- openvpn/client - openvpn/client
##
## The ansible region is an attempt to share certain zones in batcave
## with pagure.
- { role: repospanner/server, - { role: repospanner/server,
node: repospanner01, node: repospanner01,
region: ansible, region: ansible,
@ -46,10 +49,13 @@
when: inventory_hostname == 'repospanner-osuosl01.phx2.fedoraproject.org' when: inventory_hostname == 'repospanner-osuosl01.phx2.fedoraproject.org'
} }
## The RPMs region is used to sync up pkgs from Fedora and CentOS. The
## CentOS nodes are the spawn leaders for this as they are getting data
## first.
- { role: repospanner/server, - { role: repospanner/server,
node: fedora01, node: fedora01,
region: rpms, region: rpms,
spawn_repospanner_node: true, spawn_repospanner_node: false,
rpc_port: 8444, rpc_port: 8444,
http_port: 8445, http_port: 8445,
when: inventory_hostname == 'repospanner-cc-rdu01.phx2.fedoraproject.org' when: inventory_hostname == 'repospanner-cc-rdu01.phx2.fedoraproject.org'