hetzner-ansible/hcloud_firewall.yml

---

# updates firewall config

# Parameters:
#   playbook inventory
#     stage := the name of the stage (e.g. devnso, qanso, prodnso)

#############################################################
#   Creating inventory dynamically for given parameters
#############################################################

- hosts: localhost
  gather_facts: false
  connection: local

  pre_tasks:
    - name: "Import constraints check"
      import_tasks: tasks/constraints_check.yml
      become: false
      tags:
        - always

#     add virtual server to load stage specific variables as context
    - name: "Add <{{ stage }}-virtual-host-to-read-groups-vars> to hosts"
      add_host:
        name: "{{ stage }}-virtual-host-to-read-groups-vars"
        groups:
        - "stage_{{ stage }}"
      changed_when: False

#############################################################
#   Creating inventory dynamically for given parameters
#############################################################

- hosts: "{{ stage }}-virtual-host-to-read-groups-vars"
  serial: "{{ serial_number | default(1) }}"
  gather_facts: false
  connection: local

  pre_tasks:
    - name: "Import autodiscover pre-tasks"
      import_tasks: tasks/autodiscover_pre_tasks.yml
      become: false
      tags:
        - always

  tasks:
    - name: "Print IP Whitelist"
      ansible.builtin.debug:
        msg: "Whitelisted IPs <{{ ip_whitelist | join(',') }}>"

    - name: "Setup base hcloud firewall rules"
      include_role:
        name: hetzner-ansible-hcloud
        tasks_from: configure-firewall2
      loop: "{{ hcloud_firewall_objects }}"
      loop_control:
        loop_var: firewall_object

    - name: "Generate awx-related hcloud firewall rules"
      block:
      - name: "Lookup hetzner servers - smaradigo k8s worker nodes"
        delegate_to: localhost
        hcloud_server_info:
          api_token: "{{ hetzner_authentication_ansible_vault }}"
          label_selector: "service=kube_node,stage={{ stage }}"
        register: found_servers

      - name: "Initial VAR(s)"
        set_fact:
          k8s_worker_node_ips: []

      - name: "Get IPs from k8s worker nodes"
        set_fact:
          k8s_worker_node_ips: '{{ k8s_worker_node_ips + [ item + "/32" ] }}'
        loop: '{{ found_servers.hcloud_server_info | selectattr("ipv4_address","defined") | map(attribute="ipv4_address") }}'

      - name: "Setup hcloud firewalls for AWX stuff..."
        include_role:
          name: hetzner-ansible-hcloud
          tasks_from: configure-firewall2
        loop: "{{ hcloud_firewall_objects_awx }}"
        loop_control:
          loop_var: firewall_object

      - name: "Setup hcloud firewalls for vpn stuff..."
        include_role:
          name: hetzner-ansible-hcloud
          tasks_from: configure-firewall2
        loop: "{{ hcloud_firewall_objects_vpn }}"
        loop_control:
          loop_var: firewall_object

      - name: "Setup hcloud firewalls for database backup..."
        include_role:
          name: hetzner-ansible-hcloud
          tasks_from: configure-firewall2
        loop: "{{ hcloud_firewall_objects_backup }}"
        loop_control:
          loop_var: firewall_object
  
      - name: "Setup hcloud firewalls for gitea..."
        include_role:
          name: hetzner-ansible-hcloud
          tasks_from: configure-firewall2
        loop: "{{ hcloud_firewall_objects_gitea }}"
        loop_control:
          loop_var: firewall_object
  
      - name: "Setup hcloud firewalls for keycloak..."
        include_role:
          name: hetzner-ansible-hcloud
          tasks_from: configure-firewall2
        loop: "{{ hcloud_firewall_objects_keycloak }}"
        loop_control:
          loop_var: firewall_object
  
      - name: "Setup hcloud firewalls for kibana..."
        include_role:
          name: hetzner-ansible-hcloud
          tasks_from: configure-firewall2
        loop: "{{ hcloud_firewall_objects_kibana }}"
        loop_control:
          loop_var: firewall_object
  
      - name: "Setup hcloud firewalls for management..."
        include_role:
          name: hetzner-ansible-hcloud
          tasks_from: configure-firewall2
        loop: "{{ hcloud_firewall_objects_management }}"
        loop_control:
          loop_var: firewall_object
      
      - name: "Setup hcloud firewalls for cockpit..."
        include_role:
          name: hetzner-ansible-hcloud
          tasks_from: configure-firewall2
        loop: "{{ hcloud_firewall_objects_cockpit }}"
        loop_control:
          loop_var: firewall_object
        when: stage == 'demompmx'
      # end of BLOCK
      when: hcloud_firewall_app_specific_stuff | default(True)