majic-ansible-roles Files · roles/common/templates/00-base.conf.j2

Files @ b68d19ad38a3

Branch filter:

Location: majic-ansible-roles/roles/common/templates/00-base.conf.j2

b68d19ad38a3 3.3 KiB text/plain Show Annotation Show as Raw Download as Raw

branko

MAR-33: Added initial scaffolding for wsgi_website tests:

- Added Molecule configuration file.
- Implemented test playbook that sets-up three separate instances of WSGI
website in order to test all variations of parameters.
- Added name for the set_fact task.
- Fixed linting errors related to mode that lacks leading zero.
- Added skip_ansible_lint tag for command that creates the Python virtual
environment.
- Added missing become keyword wherever become_user is specified.
- Fixed invalid parameter name for specifying if HTTPS should be enforced or
not.
- Added small initial sample WSGI apps that get deployed.
- Added static/media sample files.
- Added TLS material.
- Added initial dummy test file.

# IPv4
domain ip {
    table filter {
        chain INPUT {
            policy DROP;
            interface lo ACCEPT;
            # Make sure not to allow flooding via ICMP ping packages by sending them
            # to flood chain before state module kicks in.
            proto icmp icmp-type echo-request jump flood;
            mod state state (ESTABLISHED RELATED) ACCEPT;
            # For TCP packages we perform floods checks after state module took care
            # of established and related connections.
            proto tcp tcp-flags (FIN SYN RST ACK) SYN jump flood;
            # Accept some common incoming connections.
            proto icmp icmp-type echo-request ACCEPT;
            proto tcp dport 22 ACCEPT;
        }

        # The flood chain is used for controlling the rate of the incoming connections.
        chain flood {
            # Rate-limit the ping requests.
            proto icmp icmp-type echo-request {
                mod hashlimit hashlimit {{ incoming_connection_limit }} hashlimit-burst {{ incoming_connection_limit_burst }}
                    hashlimit-mode srcip hashlimit-name icmp RETURN;
                DROP;
            }
            # Rate-limit the TCP connections.
            proto tcp tcp-flags (FIN SYN RST ACK) SYN {
                mod hashlimit hashlimit {{ incoming_connection_limit }} hashlimit-burst {{ incoming_connection_limit_burst }}
                    hashlimit-mode srcip hashlimit-name icmp RETURN;
                LOG;
                DROP;
            }
        }
    }
}

# IPv6, same as IPv4 config, with addition of a couple of ICMP packets.
domain ip6 {
    table filter {
        chain INPUT {
            policy DROP;
            interface lo ACCEPT;
            # Make sure not to allow flooding via ICMP ping packages by sending them
            # to flood chain before state module kicks in.
            proto icmp icmp-type echo-request jump flood;
            mod state state (ESTABLISHED RELATED) ACCEPT;
            # For TCP packages we perform floods checks after state module took care
            # of established and related connections.
            proto tcp tcp-flags (FIN SYN RST ACK) SYN jump flood;
            # ICMPv6 packets required for proper functioning of IPv6.
            proto icmp icmp-type router-advertisement ACCEPT;
            proto icmp icmp-type neighbor-solicitation ACCEPT;
            proto icmp icmp-type neighbor-advertisement ACCEPT;
            # Accept some common incoming connections.
            proto icmp icmp-type echo-request ACCEPT;
            proto tcp dport 22 ACCEPT;
        }

        # The flood chain is used for controlling the rate of the incoming connections.
        chain flood {
            # Rate-limit the ping requests.
            proto icmp icmp-type echo-request {
                mod hashlimit hashlimit {{ incoming_connection_limit }} hashlimit-burst {{ incoming_connection_limit_burst }}
                    hashlimit-mode srcip hashlimit-name icmp RETURN;
                DROP;
            }
            # Rate-limit the TCP connections.
            proto tcp tcp-flags (FIN SYN RST ACK) SYN {
                mod hashlimit hashlimit {{ incoming_connection_limit }} hashlimit-burst {{ incoming_connection_limit_burst }}
                    hashlimit-mode srcip hashlimit-name icmp RETURN;
                LOG;
                DROP;
            }
        }
    }
}