Mercurial > repos > other > Puppet

comparison modules/my_fw/manifests/pre.pp @ 480:2c3e745be8d2

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Update server defs and own modules to match * $osver and $fqdn and others are now all in $facts * Firewall swapped action for jump and has new way to do IPv6 * SSH server setup changed * Resolve warnings from fileserver.conf * has_key() no longer exists because Puppet can do "key in array" * Some variables are now more strictly typed Also: * Try to configure full IPv6 DNS resolver * Clean up old config - unused servers and some CentOS complexity
author IBBoard <dev@ibboard.co.uk>
date Thu, 29 Aug 2024 18:58:49 +0100
parents 11d940c9014e
children
comparison
equal deleted inserted replaced
479:162dc4376331 480:2c3e745be8d2
6 $icmp_proto = $my_fw::ip_version == "IPv6" ? { true => 'ipv6-icmp', default => 'icmp' } 6 $icmp_proto = $my_fw::ip_version == "IPv6" ? { true => 'ipv6-icmp', default => 'icmp' }
7 $localhost = $my_fw::ip_version == "IPv6" ? { true => '::1/128', default => '127.0.0.0/8' } 7 $localhost = $my_fw::ip_version == "IPv6" ? { true => '::1/128', default => '127.0.0.0/8' }
8 8
9 # Default firewall rules 9 # Default firewall rules
10 firewall { '000 accept all icmp': 10 firewall { '000 accept all icmp':
11 proto => $icmp_proto, 11 proto => $icmp_proto,
12 action => 'accept', 12 jump => 'accept',
13 } -> 13 } ->
14 firewall { '001 accept all to lo interface': 14 firewall { '001 accept all to lo interface':
15 proto => 'all', 15 proto => 'all',
16 iniface => 'lo', 16 iniface => 'lo',
17 action => 'accept', 17 jump => 'accept',
18 } -> 18 } ->
19 firewall { "002 reject local traffic not on loopback interface": 19 firewall { "002 reject local traffic not on loopback interface":
20 iniface => '! lo', 20 iniface => '! lo',
21 proto => 'all', 21 proto => 'all',
22 destination => $localhost, 22 destination => $localhost,
23 action => 'reject', 23 jump => 'reject',
24 } -> 24 } ->
25 firewall { '005 accept related established rules': 25 firewall { '005 accept related established rules':
26 proto => 'all', 26 proto => 'all',
27 state => ['RELATED', 'ESTABLISHED'], 27 state => ['RELATED', 'ESTABLISHED'],
28 action => 'accept', 28 jump => 'accept',
29 } 29 }
30 } 30 }