You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
291 lines
8.1 KiB
YAML
291 lines
8.1 KiB
YAML
---
|
|
hcloud_firewall_objects:
|
|
-
|
|
name: "{{ stage }}-default"
|
|
state: present
|
|
rules:
|
|
-
|
|
direction: in
|
|
protocol: icmp
|
|
port: ''
|
|
source_ips: '{{ ip_whitelist }}'
|
|
destination_ips: []
|
|
description: "ICMP allowed"
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '22'
|
|
source_ips: '{{ ip_whitelist }}'
|
|
destination_ips: []
|
|
description: "Allow access to SSH for whitelisted ips"
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '80'
|
|
source_ips: '{{ ip_whitelist }}'
|
|
destination_ips: []
|
|
description: "Allow access to HTTP for whitelisted ips"
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '443'
|
|
source_ips: '{{ ip_whitelist }}'
|
|
destination_ips: []
|
|
description: "Allow access to HTTPS for whitelisted ips"
|
|
apply_to:
|
|
-
|
|
type: label_selector
|
|
label_selector:
|
|
selector: 'stage={{ stage }}'
|
|
-
|
|
name: "{{ stage }}-monitoring"
|
|
state: present
|
|
rules:
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '9080-9085'
|
|
source_ips: '{{ ip_whitelist + [ lookup("community.general.dig", stage + "-prometheus-01." + domain ) + "/32"] }}'
|
|
destination_ips: []
|
|
description: "Allow access to Server/Service Monitoring for whitelisted ips"
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '9001'
|
|
source_ips: '{{ ip_whitelist }}'
|
|
destination_ips: []
|
|
description: "Allow access to PgAdmin Monitoring for whitelisted ips"
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '9187'
|
|
source_ips: '{{ ip_whitelist }}'
|
|
destination_ips: []
|
|
description: "Allow access to Postgres-Exporter Monitoring for whitelisted ips"
|
|
apply_to:
|
|
-
|
|
type: label_selector
|
|
label_selector:
|
|
selector: 'stage={{ stage }}'
|
|
-
|
|
name: "{{ stage }}-monitoring-extern-https"
|
|
state: present
|
|
rules:
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '443'
|
|
source_ips:
|
|
- "{{ lookup('community.general.dig', '{{ shared_service_hostname_blackbox_exporter }}' ) }}/32"
|
|
destination_ips: []
|
|
description: "Allow access to Blackbox Monitoring for whitelisted ips"
|
|
apply_to:
|
|
-
|
|
type: label_selector
|
|
label_selector:
|
|
selector: 'stage={{ stage }},service=connect'
|
|
-
|
|
type: label_selector
|
|
label_selector:
|
|
selector: 'stage={{ stage }},service=keycloak'
|
|
-
|
|
name: "{{ stage }}-access-to-kubernetes-api"
|
|
state: present
|
|
rules:
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '6443'
|
|
source_ips: "{{ ip_whitelist }}"
|
|
destination_ips: []
|
|
description: "Allow access to K8-API for whitelisted ips"
|
|
apply_to:
|
|
-
|
|
type: label_selector
|
|
label_selector:
|
|
selector: 'stage={{ stage }},service=kube_control_plane'
|
|
|
|
hcloud_firewall_objects_awx:
|
|
-
|
|
name: "{{ stage }}-awx-ssh-access-for-k8s-nodes"
|
|
state: present
|
|
rules:
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '22'
|
|
source_ips: "{{ k8s_worker_node_ips }}"
|
|
destination_ips: []
|
|
description: "Allow access to SSH from kubernetes worker nodes"
|
|
apply_to:
|
|
-
|
|
type: label_selector
|
|
label_selector:
|
|
selector: 'stage={{ stage }},service'
|
|
|
|
hcloud_firewall_objects_vpn:
|
|
-
|
|
name: "{{ stage }}-vpn-access"
|
|
state: present
|
|
rules:
|
|
-
|
|
direction: in
|
|
protocol: udp
|
|
port: "{{ service_port_wireguard }}"
|
|
source_ips:
|
|
- "0.0.0.0/0"
|
|
destination_ips: []
|
|
description: "Allow access to VPN"
|
|
apply_to:
|
|
-
|
|
type: label_selector
|
|
label_selector:
|
|
selector: 'stage={{ stage }},service=vpn'
|
|
|
|
hcloud_firewall_objects_backup:
|
|
-
|
|
name: "{{ stage }}-backup-ssh-access"
|
|
state: present
|
|
rules:
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '22'
|
|
source_ips:
|
|
- "{{ offsite_storage_server_ip }}"
|
|
destination_ips: []
|
|
description: "Allow access to BACKUP from offsite"
|
|
apply_to:
|
|
-
|
|
type: label_selector
|
|
label_selector:
|
|
selector: 'stage={{ stage }},service=backup'
|
|
|
|
hcloud_firewall_objects_gitea:
|
|
-
|
|
name: "{{ stage }}-access-to-gitea"
|
|
state: present
|
|
rules:
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '443'
|
|
source_ips: "{{ ip_whitelist }}"
|
|
destination_ips: []
|
|
description: "Allow access to GITEA for whitelisted ips"
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '443'
|
|
source_ips: "{{ [shared_service_network] + k8s_worker_node_ips }}"
|
|
destination_ips: []
|
|
description: "Allow access to GITEA for kubernetes worker nodes"
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '443'
|
|
source_ips: "{{ [shared_service_network] + (gitea_https_whitelisted_ips | default([])) }}"
|
|
destination_ips: []
|
|
description: "Allow access to GITEA for custom whitelisted ips"
|
|
apply_to:
|
|
-
|
|
type: label_selector
|
|
label_selector:
|
|
selector: 'stage={{ stage }},service=gitea'
|
|
|
|
hcloud_firewall_objects_keycloak:
|
|
-
|
|
name: "{{ stage }}-access-to-keycloak"
|
|
state: present
|
|
rules:
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '443'
|
|
source_ips: "{{ ip_whitelist }}"
|
|
destination_ips: []
|
|
description: "Allow access to KEYCLOAK for custom whitelisted ips"
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '443'
|
|
source_ips: "{{ [shared_service_network] + k8s_worker_node_ips }}"
|
|
destination_ips: []
|
|
description: "Allow access to KEYCLOAK for kubernetes worker nodes"
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '443'
|
|
source_ips: "{{ [shared_service_network] + (keycloak_https_whitelisted_ips | default([])) }}"
|
|
destination_ips: []
|
|
description: "Allow access to KEYCLOAK for custom whitelisted ips"
|
|
apply_to:
|
|
-
|
|
type: label_selector
|
|
label_selector:
|
|
selector: 'stage={{ stage }},service=keycloak'
|
|
|
|
hcloud_firewall_objects_kibana:
|
|
-
|
|
name: "{{ stage }}-access-to-kibana"
|
|
state: present
|
|
rules:
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '443'
|
|
source_ips: "{{ ip_whitelist }}"
|
|
destination_ips: []
|
|
description: "Allow access to KIBANA for whitelisted ips"
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '443'
|
|
source_ips: "{{ [shared_service_network] + k8s_worker_node_ips }}"
|
|
destination_ips: []
|
|
description: "Allow access to KIBANA for kubernetes worker nodes"
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '443'
|
|
source_ips: "{{ [shared_service_network] + (kibana_https_whitelisted_ips | default([])) }}"
|
|
destination_ips: []
|
|
description: "Allow access to KIBANA for custom whitelisted ips"
|
|
apply_to:
|
|
-
|
|
type: label_selector
|
|
label_selector:
|
|
selector: 'stage={{ stage }},service=kibana'
|
|
|
|
hcloud_firewall_objects_management:
|
|
-
|
|
name: "{{ stage }}-access-to-management"
|
|
state: present
|
|
rules:
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '443'
|
|
source_ips: "{{ ip_whitelist }}"
|
|
destination_ips: []
|
|
description: "Allow access to MANAGEMENT for whitelisted ips"
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '443'
|
|
source_ips: "{{ [shared_service_network] + k8s_worker_node_ips }}"
|
|
destination_ips: []
|
|
description: "Allow access to MANAGEMENT for kubernetes worker nodes"
|
|
-
|
|
direction: in
|
|
protocol: tcp
|
|
port: '443'
|
|
source_ips: "{{ [shared_service_network] + (management_https_whitelisted_ips | default([])) }}"
|
|
destination_ips: []
|
|
description: "Allow access to MANAGEMENT for custom whitelisted ips"
|
|
apply_to:
|
|
-
|
|
type: label_selector
|
|
label_selector:
|
|
selector: 'stage={{ stage }},service=connect,tenant=management'
|