You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
272 lines
7.2 KiB
YAML
272 lines
7.2 KiB
YAML
---
|
|
hcloud_firewall_objects:
|
|
-
|
|
name: "{{ stage }}-default"
|
|
state: present
|
|
rules:
|
|
-
|
|
direction: in
|
|
protocol: icmp
|
|
port: ''
|
|
source_ips: '{{ ip_whitelist }}'
|
|
destination_ips: []
|
|
description: ICMP allowed
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '22'
|
|
source_ips: '{{ ip_whitelist }}'
|
|
destination_ips: []
|
|
description: SSH allowed
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '80'
|
|
source_ips: '{{ ip_whitelist }}'
|
|
destination_ips: []
|
|
description: HTTP allowed
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '443'
|
|
source_ips: '{{ ip_whitelist }}'
|
|
destination_ips: []
|
|
description: HTTPS allowed
|
|
apply_to:
|
|
-
|
|
type: label_selector
|
|
label_selector:
|
|
selector: 'stage={{ stage }}'
|
|
-
|
|
name: "{{ stage }}-monitoring"
|
|
state: present
|
|
rules:
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '9080-9085'
|
|
source_ips: '{{ ip_whitelist + [ lookup("community.general.dig", stage + "-prometheus-01." + domain ) + "/32"] }}'
|
|
destination_ips: []
|
|
description: 'Server/Service Monitoring'
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '9001'
|
|
source_ips: '{{ ip_whitelist }}'
|
|
destination_ips: []
|
|
description: 'PgAdmin'
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '9187'
|
|
source_ips: '{{ ip_whitelist }}'
|
|
destination_ips: []
|
|
description: 'Postgres-Exporter'
|
|
apply_to:
|
|
-
|
|
type: label_selector
|
|
label_selector:
|
|
selector: 'stage={{ stage }}'
|
|
-
|
|
name: "{{ stage }}-monitoring-extern-https"
|
|
state: present
|
|
rules:
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '443'
|
|
source_ips:
|
|
- "{{ lookup('community.general.dig', 'dev-blackbox-01.smardigo.digital' ) }}/32"
|
|
destination_ips: []
|
|
description: null
|
|
apply_to:
|
|
-
|
|
type: label_selector
|
|
label_selector:
|
|
selector: 'stage={{ stage }},service=connect'
|
|
-
|
|
type: label_selector
|
|
label_selector:
|
|
selector: 'stage={{ stage }},service=keycloak'
|
|
-
|
|
name: "{{ stage }}-access-to-kubernetes-api"
|
|
state: present
|
|
rules:
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '6443'
|
|
source_ips: "{{ ip_whitelist }}"
|
|
destination_ips: []
|
|
description: "Allow access for whitelisted ips"
|
|
apply_to:
|
|
-
|
|
type: label_selector
|
|
label_selector:
|
|
selector: 'stage={{ stage }},service=kube_control_plane'
|
|
|
|
hcloud_firewall_objects_awx:
|
|
-
|
|
name: "{{ stage }}-awx-ssh-access-for-k8s-nodes"
|
|
state: present
|
|
rules:
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '22'
|
|
source_ips: "{{ k8s_worker_node_ips }}"
|
|
destination_ips: []
|
|
description: "Allow access for kubernetes worker nodes"
|
|
apply_to:
|
|
-
|
|
type: label_selector
|
|
label_selector:
|
|
selector: 'stage={{ stage }},service'
|
|
|
|
hcloud_firewall_objects_backup:
|
|
-
|
|
name: "{{ stage }}-backup-ssh-access"
|
|
state: present
|
|
rules:
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '22'
|
|
source_ips:
|
|
- "{{ offsite_storage_server_ip }}"
|
|
destination_ips: []
|
|
description: null
|
|
apply_to:
|
|
-
|
|
type: label_selector
|
|
label_selector:
|
|
selector: 'stage={{ stage }},service=backup'
|
|
|
|
hcloud_firewall_objects_gitea:
|
|
-
|
|
name: "{{ stage }}-access-to-gitea"
|
|
state: present
|
|
rules:
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '443'
|
|
source_ips: "{{ ip_whitelist }}"
|
|
destination_ips: []
|
|
description: "Allow access for whitelisted ips"
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '443'
|
|
source_ips: "{{ [shared_service_network] + k8s_worker_node_ips }}"
|
|
destination_ips: []
|
|
description: "Allow access for kubernetes worker nodes"
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '443'
|
|
source_ips: "{{ [shared_service_network] + (gitea_https_whitelisted_ips | default([])) }}"
|
|
destination_ips: []
|
|
description: "Allow access for custom whitelisted ips"
|
|
apply_to:
|
|
-
|
|
type: label_selector
|
|
label_selector:
|
|
selector: 'stage={{ stage }},service=gitea'
|
|
|
|
hcloud_firewall_objects_keycloak:
|
|
-
|
|
name: "{{ stage }}-access-to-keycloak"
|
|
state: present
|
|
rules:
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '443'
|
|
source_ips: "{{ ip_whitelist }}"
|
|
destination_ips: []
|
|
description: "Allow access for whitelisted ips"
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '443'
|
|
source_ips: "{{ [shared_service_network] + k8s_worker_node_ips }}"
|
|
destination_ips: []
|
|
description: "Allow access for kubernetes worker nodes"
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '443'
|
|
source_ips: "{{ [shared_service_network] + (keycloak_https_whitelisted_ips | default([])) }}"
|
|
destination_ips: []
|
|
description: "Allow access for custom whitelisted ips"
|
|
apply_to:
|
|
-
|
|
type: label_selector
|
|
label_selector:
|
|
selector: 'stage={{ stage }},service=keycloak'
|
|
|
|
hcloud_firewall_objects_kibana:
|
|
-
|
|
name: "{{ stage }}-access-to-kibana"
|
|
state: present
|
|
rules:
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '443'
|
|
source_ips: "{{ ip_whitelist }}"
|
|
destination_ips: []
|
|
description: "Allow access for whitelisted ips"
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '443'
|
|
source_ips: "{{ [shared_service_network] + k8s_worker_node_ips }}"
|
|
destination_ips: []
|
|
description: "Allow access for kubernetes worker nodes"
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '443'
|
|
source_ips: "{{ [shared_service_network] + (kibana_https_whitelisted_ips | default([])) }}"
|
|
destination_ips: []
|
|
description: "Allow access for custom whitelisted ips"
|
|
apply_to:
|
|
-
|
|
type: label_selector
|
|
label_selector:
|
|
selector: 'stage={{ stage }},service=kibana'
|
|
|
|
hcloud_firewall_objects_management:
|
|
-
|
|
name: "{{ stage }}-access-to-management"
|
|
state: present
|
|
rules:
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '443'
|
|
source_ips: "{{ ip_whitelist }}"
|
|
destination_ips: []
|
|
description: "Allow access for whitelisted ips"
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '443'
|
|
source_ips: "{{ [shared_service_network] + k8s_worker_node_ips }}"
|
|
destination_ips: []
|
|
description: "Allow access for kubernetes worker nodes"
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '443'
|
|
source_ips: "{{ [shared_service_network] + (management_https_whitelisted_ips | default([])) }}"
|
|
destination_ips: []
|
|
description: "Allow access for custom whitelisted ips"
|
|
apply_to:
|
|
-
|
|
type: label_selector
|
|
label_selector:
|
|
selector: 'stage={{ stage }},service=connect,tenant=management'
|