From dfb38ce20fc2b5c00d7de4d8719d813b962a8009 Mon Sep 17 00:00:00 2001 From: Stephen Smoogen Date: Wed, 18 Feb 2015 21:44:31 +0000 Subject: [PATCH] and we add another host on the rebuild pile. --- .../host_vars/serverbeach08.fedoraproject.org | 5 ++ playbooks/groups/virthost.yml | 2 +- .../iptables.serverbeach08.fedoraproject.org | 83 +++++++++++++++++++ 3 files changed, 89 insertions(+), 1 deletion(-) create mode 100644 inventory/host_vars/serverbeach08.fedoraproject.org create mode 100644 roles/base/templates/iptables/iptables.serverbeach08.fedoraproject.org diff --git a/inventory/host_vars/serverbeach08.fedoraproject.org b/inventory/host_vars/serverbeach08.fedoraproject.org new file mode 100644 index 0000000000..331d8c93a2 --- /dev/null +++ b/inventory/host_vars/serverbeach08.fedoraproject.org @@ -0,0 +1,5 @@ +--- +datacenter: serverbeach +nrpe_procs_warn: 900 +nrpe_procs_crit: 1000 +postfix_group: vpn diff --git a/playbooks/groups/virthost.yml b/playbooks/groups/virthost.yml index 5b248c46eb..f245e6628c 100644 --- a/playbooks/groups/virthost.yml +++ b/playbooks/groups/virthost.yml @@ -3,7 +3,7 @@ # NOTE: most of these vars_path come from group_vars/backup_server or from hostvars - name: make virthost server system - hosts: virthost:bvirthost:buildvmhost:virthost-comm03.qa.fedoraproject.org:virthost-comm04.qa.fedoraproject.org:ibiblio01.fedoraproject.org:ibiblio04.fedoraproject.org:serverbeach07.fedoraproject.org:coloamer01.fedoraproject.org:osuosl03.fedoraproject.org:host1plus01.fedoraproject.org:dedicatedsolutions01.fedoraproject.org:tummy01.fedoraproject.org:osuosl01.fedoraproject.org:virthost-comm02.qa.fedoraproject.org:serverbeach06.fedoraproject.org + hosts: virthost:bvirthost:buildvmhost:virthost-comm03.qa.fedoraproject.org:virthost-comm04.qa.fedoraproject.org:ibiblio01.fedoraproject.org:ibiblio04.fedoraproject.org:serverbeach07.fedoraproject.org:coloamer01.fedoraproject.org:osuosl03.fedoraproject.org:host1plus01.fedoraproject.org:dedicatedsolutions01.fedoraproject.org:tummy01.fedoraproject.org:osuosl01.fedoraproject.org:virthost-comm02.qa.fedoraproject.org:serverbeach06.fedoraproject.org:serverbeach08.fedoraproject.org user: root gather_facts: True diff --git a/roles/base/templates/iptables/iptables.serverbeach08.fedoraproject.org b/roles/base/templates/iptables/iptables.serverbeach08.fedoraproject.org new file mode 100644 index 0000000000..c7542a13e9 --- /dev/null +++ b/roles/base/templates/iptables/iptables.serverbeach08.fedoraproject.org @@ -0,0 +1,83 @@ +# {{ ansible_managed }} +*nat +:PREROUTING ACCEPT [7058:343124] +:INPUT ACCEPT [14:880] +:OUTPUT ACCEPT [3:224] +:POSTROUTING ACCEPT [428:23328] +# dnat and snat everything to the internal virt host +#-A PREROUTING -d guest_ip/32 -j DNAT --to-destination 192.168.122.2 +#-A POSTROUTING -s 192.168.122.2/32 -j SNAT --to-source guest_ip +-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535 +-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535 +-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] + +# allow ping and traceroute +-A INPUT -p icmp -j ACCEPT + +# localhost is fine +-A INPUT -i lo -j ACCEPT + +# Established connections allowed +-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT +-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT + +# allow ssh - always +-A INPUT -m conntrack --ctstate NEW -m tcp -p tcp --dport 22 -j ACCEPT + +# for nrpe - allow it from nocs +-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.10 -j ACCEPT +# FIXME - this is the global nat-ip and we need the noc01-specific ip +-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.102 -j ACCEPT +-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.35 -j ACCEPT +-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.41 -j ACCEPT + +{% if env != 'staging' and datacenter == 'phx2' and inventory_hostname not in groups['staging-friendly'] %} +# +# In the phx2 datacenter, both production and staging hosts are in the same +# subnet/vlan. We want production hosts to reject connectons from staging group hosts +# to prevent them from interfering with production. There are however a few hosts in +# production we have marked 'staging-friendly' that we do allow staging to talk to for +# mostly read-only data they need. +# +{% for host in groups['staging'] %} +{% if 'eth0_ip' in hostvars[host] %}# {{ host }} +-A INPUT -s {{ hostvars[host]['eth0_ip'] }} -j REJECT --reject-with icmp-host-prohibited +{% else %}# {{ host }} has no 'eth0_ip' listed +{% endif %} +{% endfor %} +{% endif %} + +# if the host/group defines incoming tcp_ports - allow them +{% if tcp_ports is defined %} +{% for port in tcp_ports %} +-A INPUT -p tcp -m tcp --dport {{ port }} -j ACCEPT +{% endfor %} +{% endif %} + +# if the host/group defines incoming udp_ports - allow them +{% if udp_ports is defined %} +{% for port in udp_ports %} +-A INPUT -p udp -m udp --dport {{ port }} -j ACCEPT +{% endfor %} +{% endif %} + +# if there are custom rules - put them in as-is +{% if custom_rules is defined %} +{% for rule in custom_rules %} +{{ rule }} +{% endfor %} +{% endif %} + +# otherwise kick everything out +-A INPUT -j REJECT --reject-with icmp-host-prohibited + +# source and dest of the guest ip we forward into the guest +#-A FORWARD -d guest_ip/32 -j ACCEPT +#-A FORWARD -s guest_ip/32 -j ACCEPT +-A FORWARD -j REJECT --reject-with icmp-host-prohibited +COMMIT