diff --git a/roles/actual/tasks/main.yml b/roles/actual/tasks/main.yml index 8302825..9ed6a2a 100644 --- a/roles/actual/tasks/main.yml +++ b/roles/actual/tasks/main.yml @@ -37,13 +37,13 @@ dest: /etc/nginx/conf.d/actual.conf mode: '0644' notify: Restart Nginx -- name: Allow https through firewall - become: true - community.general.ufw: - rule: allow - port: https - proto: tcp - notify: Restart ufw +# - name: Allow https through firewall +# become: true +# community.general.ufw: +# rule: allow +# port: https +# proto: tcp +# notify: Restart ufw - name: Debug ansible.builtin.debug: msg: "Don't forget to manually add a DNS record for actual.kleinendorst.info pointing to: {{ ansible_facts['default_ipv4']['address'] }}." diff --git a/roles/basic-intalls/tasks/main.yml b/roles/basic-intalls/tasks/main.yml index a658673..d60770f 100644 --- a/roles/basic-intalls/tasks/main.yml +++ b/roles/basic-intalls/tasks/main.yml @@ -6,7 +6,8 @@ - git - vim - dnsutils - - ufw + - rsyslog + # - ufw - podman - snapd state: present @@ -15,50 +16,45 @@ community.general.snap: name: core state: present -- name: Set default policy (incoming) - become: true - community.general.ufw: - direction: incoming - policy: deny - notify: Restart ufw -- name: Set default policy (outgoing) - become: true - community.general.ufw: - direction: outgoing - policy: allow - notify: Restart ufw -- name: Set default policy (routed) - become: true - community.general.ufw: - direction: routed - policy: allow - notify: Restart ufw -- name: Allow forwarding in ufw - become: true - ansible.builtin.lineinfile: - path: /etc/ufw/sysctl.conf - regexp: '^#net/ipv4/ip_forward=1$' - line: 'net/ipv4/ip_forward=1' - notify: Restart ufw -- name: Allow forwarding in sysctl - become: true - ansible.builtin.lineinfile: - path: /etc/sysctl.conf - regexp: '^#net\.ipv4\.ip_forward=1$' - line: net.ipv4.ip_forward=1 -- name: Allow all access to ssh - become: true - community.general.ufw: - rule: allow - port: ssh - proto: tcp - notify: Restart ufw -- name: Enable ufw - become: true - community.general.ufw: - state: enabled -- name: Install Snapcraft - become: true - ansible.builtin.apt: - name: - state: present +# - name: Set default policy (incoming) +# become: true +# community.general.ufw: +# direction: incoming +# policy: deny +# notify: Restart ufw +# - name: Set default policy (outgoing) +# become: true +# community.general.ufw: +# direction: outgoing +# policy: allow +# notify: Restart ufw +# - name: Set default policy (routed) +# become: true +# community.general.ufw: +# direction: routed +# policy: allow +# notify: Restart ufw +# - name: Allow forwarding in ufw +# become: true +# ansible.builtin.lineinfile: +# path: /etc/ufw/sysctl.conf +# regexp: '^#net/ipv4/ip_forward=1$' +# line: 'net/ipv4/ip_forward=1' +# notify: Restart ufw +# - name: Allow forwarding in sysctl +# become: true +# ansible.builtin.lineinfile: +# path: /etc/sysctl.conf +# regexp: '^#net\.ipv4\.ip_forward=1$' +# line: net.ipv4.ip_forward=1 +# - name: Allow all access to ssh +# become: true +# community.general.ufw: +# rule: allow +# port: ssh +# proto: tcp +# notify: Restart ufw +# - name: Enable ufw +# become: true +# community.general.ufw: +# state: enabled diff --git a/roles/pi-hole/tasks/main.yml b/roles/pi-hole/tasks/main.yml index 04e76c3..b7f5e54 100644 --- a/roles/pi-hole/tasks/main.yml +++ b/roles/pi-hole/tasks/main.yml @@ -74,29 +74,29 @@ - name: Debug ansible.builtin.debug: msg: "Don't forget to manually add a DNS record for pi-hole.kleinendorst.info pointing to: {{ ansible_facts['default_ipv4']['address'] }}." -- name: Add forwarding rules for ufw - become: true - ansible.builtin.blockinfile: - path: /etc/ufw/before.rules - insertbefore: "^\\*filter$" - block: | - *nat - :PREROUTING ACCEPT [0:0] - -A PREROUTING -p tcp -i eth0 --dport 53 -j DNAT \ --to-destination 127.0.0.1:5053 - -A PREROUTING -p udp -i eth0 --dport 53 -j DNAT \ --to-destination 127.0.0.1:5053 - COMMIT - notify: Restart ufw -- name: Allow all access to port 53 (udp) - become: true - community.general.ufw: - rule: allow - port: '53' - proto: udp - notify: Restart ufw -- name: Allow all access to port 53 (tcp) - become: true - community.general.ufw: - rule: allow - port: '53' - proto: tcp - notify: Restart ufw +# - name: Add forwarding rules for ufw +# become: true +# ansible.builtin.blockinfile: +# path: /etc/ufw/before.rules +# insertbefore: "^\\*filter$" +# block: | +# *nat +# :PREROUTING ACCEPT [0:0] +# -A PREROUTING -p tcp -i eth0 --dport 53 -j DNAT \ --to-destination 127.0.0.1:5053 +# -A PREROUTING -p udp -i eth0 --dport 53 -j DNAT \ --to-destination 127.0.0.1:5053 +# COMMIT +# notify: Restart ufw +# - name: Allow all access to port 53 (udp) +# become: true +# community.general.ufw: +# rule: allow +# port: '53' +# proto: udp +# notify: Restart ufw +# - name: Allow all access to port 53 (tcp) +# become: true +# community.general.ufw: +# rule: allow +# port: '53' +# proto: tcp +# notify: Restart ufw