Initial commit

2026-03-24 08:19:29 +01:00
commit 2b1ca2d5be
95 changed files with 1993 additions and 0 deletions
@@ -0,0 +1,55 @@
+# Managed by Ansible — do not edit manually
+
+*filter
+
+:INPUT DROP [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+:DOCKER-USER - [0:0]
+
+
+# --- INPUT ---
+
+# Allow loopback
+-A INPUT -i lo -j ACCEPT
+
+# Allow established/related connections
+-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+
+# Allow SSH
+-A INPUT -p tcp --dport {{ firewall_ssh_port }} -j ACCEPT
+
+# Allow additional host ports
+{% for port in firewall_allowed_tcp_ports %}
+-A INPUT -p tcp --dport {{ port }} -j ACCEPT
+{% endfor %}
+{% for port in firewall_allowed_udp_ports %}
+-A INPUT -p udp --dport {{ port }} -j ACCEPT
+{% endfor %}
+
+
+# --- DOCKER-USER ---
+
+# Allow loopback
+-A DOCKER-USER -i lo -j RETURN
+
+# Allow outgoing from Docker IP range
+-A DOCKER-USER -s 172.16.0.0/12 -j RETURN
+
+# Whitelist specific TCP ports to containers
+{% for port in docker_user_allowed_tcp_ports %}
+-A DOCKER-USER -p tcp --dport {{ port }} -j RETURN
+{% endfor %}
+
+# Whitelist specific UDP ports to containers
+{% for port in docker_user_allowed_udp_ports %}
+-A DOCKER-USER -p udp --dport {{ port }} -j RETURN
+{% endfor %}
+
+# Allow all already established connections
+-A DOCKER-USER -m conntrack --ctstate RELATED,ESTABLISHED -j RETURN
+
+# Drop everything else to containers
+-A DOCKER-USER -j DROP
+
+COMMIT
@@ -0,0 +1,55 @@
+# Managed by Ansible — do not edit manually
+
+*filter
+
+:INPUT DROP [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+:DOCKER-USER - [0:0]
+
+
+# --- INPUT ---
+
+# Allow loopback
+-A INPUT -i lo -j ACCEPT
+
+# Allow established/related connections
+-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+
+# Allow SSH
+-A INPUT -p tcp --dport {{ firewall_ssh_port }} -j ACCEPT
+
+# Allow additional host ports
+{% for port in firewall_allowed_tcp_ports %}
+-A INPUT -p tcp --dport {{ port }} -j ACCEPT
+{% endfor %}
+{% for port in firewall_allowed_udp_ports %}
+-A INPUT -p udp --dport {{ port }} -j ACCEPT
+{% endfor %}
+
+
+# --- DOCKER-USER ---
+
+# Allow loopback
+-A DOCKER-USER -i lo -j RETURN
+
+# Allow outgoing from Docker IP range
+-A DOCKER-USER -s 172.16.0.0/12 -j RETURN
+
+# Whitelist specific TCP ports to containers
+{% for port in docker_user_allowed_tcp_ports %}
+-A DOCKER-USER -p tcp --dport {{ port }} -j RETURN
+{% endfor %}
+
+# Whitelist specific UDP ports to containers
+{% for port in docker_user_allowed_udp_ports %}
+-A DOCKER-USER -p udp --dport {{ port }} -j RETURN
+{% endfor %}
+
+# Allow all already established connections
+-A DOCKER-USER -m conntrack --ctstate RELATED,ESTABLISHED -j RETURN
+
+# Drop everything else to containers
+-A DOCKER-USER -j DROP
+
+COMMIT
@@ -0,0 +1,23 @@
+# Managed by Ansible — do not edit manually
+
+[Interface]
+Address = {{ wg_nets[wg_if].hosts[inventory_hostname].address }}
+ListenPort = {{ wg_nets[wg_if].hosts[inventory_hostname].port }}
+PrivateKey = {{ wg_nets[wg_if].secrect[inventory_hostname].private_key }}
+{% if wg_nets[wg_if].hosts[inventory_hostname].dnsserver is defined %}
+DNS = {{ wg_nets[wg_if].hosts[inventory_hostname].dnsserver }}
+{% endif %}
+
+{% for peer, data in wg_nets[wg_if].hosts[inventory_hostname].peers.items() %}
+# {{ peer }}
+[Peer]
+PublicKey = {{ wg_nets[wg_if].hosts[peer].public_key }}
+AllowedIPs = {{ data.allowed_ips }}
+{% if data.preshared_key is defined %}
+PresharedKey = {{ data.preshared_key }}
+{% endif %}
+{% if data.keepalive is defined %}
+PersistentKeepalive = {{ data.keepalive }}
+{% endif %}
+
+{% endfor %}