Files
@ b68d19ad38a3
Branch filter:
Location: majic-ansible-roles/roles/common/templates/00-base.conf.j2 - annotation
b68d19ad38a3
3.3 KiB
text/plain
MAR-33: Added initial scaffolding for wsgi_website tests:
- Added Molecule configuration file.
- Implemented test playbook that sets-up three separate instances of WSGI
website in order to test all variations of parameters.
- Added name for the set_fact task.
- Fixed linting errors related to mode that lacks leading zero.
- Added skip_ansible_lint tag for command that creates the Python virtual
environment.
- Added missing become keyword wherever become_user is specified.
- Fixed invalid parameter name for specifying if HTTPS should be enforced or
not.
- Added small initial sample WSGI apps that get deployed.
- Added static/media sample files.
- Added TLS material.
- Added initial dummy test file.
- Added Molecule configuration file.
- Implemented test playbook that sets-up three separate instances of WSGI
website in order to test all variations of parameters.
- Added name for the set_fact task.
- Fixed linting errors related to mode that lacks leading zero.
- Added skip_ansible_lint tag for command that creates the Python virtual
environment.
- Added missing become keyword wherever become_user is specified.
- Fixed invalid parameter name for specifying if HTTPS should be enforced or
not.
- Added small initial sample WSGI apps that get deployed.
- Added static/media sample files.
- Added TLS material.
- Added initial dummy test file.
7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 941f4f372672 7df70ebc439c 941f4f372672 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 941f4f372672 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 7df70ebc439c 941f4f372672 941f4f372672 941f4f372672 | # IPv4
domain ip {
table filter {
chain INPUT {
policy DROP;
interface lo ACCEPT;
# Make sure not to allow flooding via ICMP ping packages by sending them
# to flood chain before state module kicks in.
proto icmp icmp-type echo-request jump flood;
mod state state (ESTABLISHED RELATED) ACCEPT;
# For TCP packages we perform floods checks after state module took care
# of established and related connections.
proto tcp tcp-flags (FIN SYN RST ACK) SYN jump flood;
# Accept some common incoming connections.
proto icmp icmp-type echo-request ACCEPT;
proto tcp dport 22 ACCEPT;
}
# The flood chain is used for controlling the rate of the incoming connections.
chain flood {
# Rate-limit the ping requests.
proto icmp icmp-type echo-request {
mod hashlimit hashlimit {{ incoming_connection_limit }} hashlimit-burst {{ incoming_connection_limit_burst }}
hashlimit-mode srcip hashlimit-name icmp RETURN;
DROP;
}
# Rate-limit the TCP connections.
proto tcp tcp-flags (FIN SYN RST ACK) SYN {
mod hashlimit hashlimit {{ incoming_connection_limit }} hashlimit-burst {{ incoming_connection_limit_burst }}
hashlimit-mode srcip hashlimit-name icmp RETURN;
LOG;
DROP;
}
}
}
}
# IPv6, same as IPv4 config, with addition of a couple of ICMP packets.
domain ip6 {
table filter {
chain INPUT {
policy DROP;
interface lo ACCEPT;
# Make sure not to allow flooding via ICMP ping packages by sending them
# to flood chain before state module kicks in.
proto icmp icmp-type echo-request jump flood;
mod state state (ESTABLISHED RELATED) ACCEPT;
# For TCP packages we perform floods checks after state module took care
# of established and related connections.
proto tcp tcp-flags (FIN SYN RST ACK) SYN jump flood;
# ICMPv6 packets required for proper functioning of IPv6.
proto icmp icmp-type router-advertisement ACCEPT;
proto icmp icmp-type neighbor-solicitation ACCEPT;
proto icmp icmp-type neighbor-advertisement ACCEPT;
# Accept some common incoming connections.
proto icmp icmp-type echo-request ACCEPT;
proto tcp dport 22 ACCEPT;
}
# The flood chain is used for controlling the rate of the incoming connections.
chain flood {
# Rate-limit the ping requests.
proto icmp icmp-type echo-request {
mod hashlimit hashlimit {{ incoming_connection_limit }} hashlimit-burst {{ incoming_connection_limit_burst }}
hashlimit-mode srcip hashlimit-name icmp RETURN;
DROP;
}
# Rate-limit the TCP connections.
proto tcp tcp-flags (FIN SYN RST ACK) SYN {
mod hashlimit hashlimit {{ incoming_connection_limit }} hashlimit-burst {{ incoming_connection_limit_burst }}
hashlimit-mode srcip hashlimit-name icmp RETURN;
LOG;
DROP;
}
}
}
}
|