From 41c8b44bd10dcd2cb9b4d649667604833a73fabb Mon Sep 17 00:00:00 2001 From: Emmanuel Garette Date: Wed, 29 Jun 2022 11:44:01 +0200 Subject: [PATCH] manage firewall for host --- .../base-debian/applicationservice.yml | 2 +- .../base-fedora/applicationservice.yml | 2 +- .../templates/update-ca-trust.service | 1 - .../base-machine/applicationservice.yml | 4 ++++ .../dictionaries/12-base.xml | 2 -- .../2022.03.08/{base => base-machine}/doc.md | 0 .../extras/machine/00_base.xml | 0 .../{base => base-machine}/funcs/funcs.py | 13 +--------- .../manual/install/config.sh | 0 .../manual/install/config_machine.sh | 0 .../manual/install/diff.py | 0 .../manual/install/install_host | 0 .../manual/install/install_image | 0 .../manual/install/install_images | 0 .../manual/install/install_machine | 0 .../manual/install/install_machines | 0 .../manual/install/make_changelog | 0 .../manual/install/make_volatile | 0 .../templates/locale.conf | 0 .../2022.03.08/base/applicationservice.yml | 2 +- .../2022.03.08/base/funcs/base.py | 9 +++++++ .../dovecot/dictionaries/26_dovecot.xml | 2 +- .../gitea/dictionaries/31_gitea.xml | 2 +- .../applicationservice.yml | 2 ++ .../dictionaries/21-machined.xml | 2 ++ .../2022.03.08/host-systemd-machined/doc.md | 2 +- .../extras/machined/00-machined.xml | 3 ++- .../host-systemd-machined/templates/nspawn | 2 +- .../templates/risottofirewall.service | 24 +++++++++++++++++++ .../dictionaries/25_nginx.xml | 2 +- .../postfix-relay/dictionaries/30_postfix.xml | 5 +++- .../dictionaries/16-machined.xml | 13 +++++++--- .../2022.03.08/systemd/applicationservice.yml | 2 +- .../unbound/dictionaries/20_unbound.xml | 4 ++++ 34 files changed, 71 insertions(+), 29 deletions(-) create mode 100644 seed/applicationservice/2022.03.08/base-machine/applicationservice.yml rename seed/applicationservice/2022.03.08/{base => base-machine}/dictionaries/12-base.xml (96%) rename seed/applicationservice/2022.03.08/{base => base-machine}/doc.md (100%) rename seed/applicationservice/2022.03.08/{base => base-machine}/extras/machine/00_base.xml (100%) rename seed/applicationservice/2022.03.08/{base => base-machine}/funcs/funcs.py (90%) rename seed/applicationservice/2022.03.08/{base => base-machine}/manual/install/config.sh (100%) rename seed/applicationservice/2022.03.08/{base => base-machine}/manual/install/config_machine.sh (100%) rename seed/applicationservice/2022.03.08/{base => base-machine}/manual/install/diff.py (100%) rename seed/applicationservice/2022.03.08/{base => base-machine}/manual/install/install_host (100%) rename seed/applicationservice/2022.03.08/{base => base-machine}/manual/install/install_image (100%) rename seed/applicationservice/2022.03.08/{base => base-machine}/manual/install/install_images (100%) rename seed/applicationservice/2022.03.08/{base => base-machine}/manual/install/install_machine (100%) rename seed/applicationservice/2022.03.08/{base => base-machine}/manual/install/install_machines (100%) rename seed/applicationservice/2022.03.08/{base => base-machine}/manual/install/make_changelog (100%) rename seed/applicationservice/2022.03.08/{base => base-machine}/manual/install/make_volatile (100%) rename seed/applicationservice/2022.03.08/{base => base-machine}/templates/locale.conf (100%) create mode 100644 seed/applicationservice/2022.03.08/base/funcs/base.py create mode 100644 seed/applicationservice/2022.03.08/host-systemd-machined/templates/risottofirewall.service diff --git a/seed/applicationservice/2022.03.08/base-debian/applicationservice.yml b/seed/applicationservice/2022.03.08/base-debian/applicationservice.yml index 3d7d7471..afedc8c7 100644 --- a/seed/applicationservice/2022.03.08/base-debian/applicationservice.yml +++ b/seed/applicationservice/2022.03.08/base-debian/applicationservice.yml @@ -1,5 +1,5 @@ format: '0.1' description: Information de base d'un serveur Debian depends: - - base + - base-machine - systemd diff --git a/seed/applicationservice/2022.03.08/base-fedora/applicationservice.yml b/seed/applicationservice/2022.03.08/base-fedora/applicationservice.yml index f9616709..32ea7abe 100644 --- a/seed/applicationservice/2022.03.08/base-fedora/applicationservice.yml +++ b/seed/applicationservice/2022.03.08/base-fedora/applicationservice.yml @@ -1,5 +1,5 @@ format: '0.1' description: Information de base d'un serveur Fedora depends: - - base + - base-machine - systemd diff --git a/seed/applicationservice/2022.03.08/base-fedora/templates/update-ca-trust.service b/seed/applicationservice/2022.03.08/base-fedora/templates/update-ca-trust.service index ace2152d..23399838 100644 --- a/seed/applicationservice/2022.03.08/base-fedora/templates/update-ca-trust.service +++ b/seed/applicationservice/2022.03.08/base-fedora/templates/update-ca-trust.service @@ -8,4 +8,3 @@ ExecStart=/usr/bin/update-ca-trust [Install] WantedBy=multi-user.target - diff --git a/seed/applicationservice/2022.03.08/base-machine/applicationservice.yml b/seed/applicationservice/2022.03.08/base-machine/applicationservice.yml new file mode 100644 index 00000000..faed7a84 --- /dev/null +++ b/seed/applicationservice/2022.03.08/base-machine/applicationservice.yml @@ -0,0 +1,4 @@ +format: '0.1' +description: Base information for a machine +depends: + - base diff --git a/seed/applicationservice/2022.03.08/base/dictionaries/12-base.xml b/seed/applicationservice/2022.03.08/base-machine/dictionaries/12-base.xml similarity index 96% rename from seed/applicationservice/2022.03.08/base/dictionaries/12-base.xml rename to seed/applicationservice/2022.03.08/base-machine/dictionaries/12-base.xml index 553c19a6..20dbf7b1 100644 --- a/seed/applicationservice/2022.03.08/base/dictionaries/12-base.xml +++ b/seed/applicationservice/2022.03.08/base-machine/dictionaries/12-base.xml @@ -46,8 +46,6 @@ server_name - zones_name - ip_eth diff --git a/seed/applicationservice/2022.03.08/base/doc.md b/seed/applicationservice/2022.03.08/base-machine/doc.md similarity index 100% rename from seed/applicationservice/2022.03.08/base/doc.md rename to seed/applicationservice/2022.03.08/base-machine/doc.md diff --git a/seed/applicationservice/2022.03.08/base/extras/machine/00_base.xml b/seed/applicationservice/2022.03.08/base-machine/extras/machine/00_base.xml similarity index 100% rename from seed/applicationservice/2022.03.08/base/extras/machine/00_base.xml rename to seed/applicationservice/2022.03.08/base-machine/extras/machine/00_base.xml diff --git a/seed/applicationservice/2022.03.08/base/funcs/funcs.py b/seed/applicationservice/2022.03.08/base-machine/funcs/funcs.py similarity index 90% rename from seed/applicationservice/2022.03.08/base/funcs/funcs.py rename to seed/applicationservice/2022.03.08/base-machine/funcs/funcs.py index bd0e6e26..848abfaf 100644 --- a/seed/applicationservice/2022.03.08/base/funcs/funcs.py +++ b/seed/applicationservice/2022.03.08/base-machine/funcs/funcs.py @@ -1,5 +1,4 @@ import __main__ -from typing import List from secrets import token_urlsafe as _token_urlsafe, token_hex as _token_hex from string import ascii_letters as _ascii_letters from random import choice as _choice @@ -7,7 +6,7 @@ from os.path import dirname as _dirname, abspath as _abspath, join as _join, isf from os import makedirs as _makedirs -from risotto.utils import load_domains, DOMAINS, ZONES_SERVER +from risotto.utils import ZONES_SERVER _HERE = _dirname(_abspath(__main__.__file__)) @@ -103,16 +102,6 @@ def get_domain_name(server_name: str, return extra_domainnames[index - 1] -def get_ip(server_name: str, - zones_name: List[str], - index: str, - ) -> str: - load_domains() - host_name, domain_name = server_name.split('.', 1) - domain = DOMAINS[domain_name] - return domain[1][domain[0].index(host_name)] - - def get_provider_name(network_name: str, provider: str, ) -> str: diff --git a/seed/applicationservice/2022.03.08/base/manual/install/config.sh b/seed/applicationservice/2022.03.08/base-machine/manual/install/config.sh similarity index 100% rename from seed/applicationservice/2022.03.08/base/manual/install/config.sh rename to seed/applicationservice/2022.03.08/base-machine/manual/install/config.sh diff --git a/seed/applicationservice/2022.03.08/base/manual/install/config_machine.sh b/seed/applicationservice/2022.03.08/base-machine/manual/install/config_machine.sh similarity index 100% rename from seed/applicationservice/2022.03.08/base/manual/install/config_machine.sh rename to seed/applicationservice/2022.03.08/base-machine/manual/install/config_machine.sh diff --git a/seed/applicationservice/2022.03.08/base/manual/install/diff.py b/seed/applicationservice/2022.03.08/base-machine/manual/install/diff.py similarity index 100% rename from seed/applicationservice/2022.03.08/base/manual/install/diff.py rename to seed/applicationservice/2022.03.08/base-machine/manual/install/diff.py diff --git a/seed/applicationservice/2022.03.08/base/manual/install/install_host b/seed/applicationservice/2022.03.08/base-machine/manual/install/install_host similarity index 100% rename from seed/applicationservice/2022.03.08/base/manual/install/install_host rename to seed/applicationservice/2022.03.08/base-machine/manual/install/install_host diff --git a/seed/applicationservice/2022.03.08/base/manual/install/install_image b/seed/applicationservice/2022.03.08/base-machine/manual/install/install_image similarity index 100% rename from seed/applicationservice/2022.03.08/base/manual/install/install_image rename to seed/applicationservice/2022.03.08/base-machine/manual/install/install_image diff --git a/seed/applicationservice/2022.03.08/base/manual/install/install_images b/seed/applicationservice/2022.03.08/base-machine/manual/install/install_images similarity index 100% rename from seed/applicationservice/2022.03.08/base/manual/install/install_images rename to seed/applicationservice/2022.03.08/base-machine/manual/install/install_images diff --git a/seed/applicationservice/2022.03.08/base/manual/install/install_machine b/seed/applicationservice/2022.03.08/base-machine/manual/install/install_machine similarity index 100% rename from seed/applicationservice/2022.03.08/base/manual/install/install_machine rename to seed/applicationservice/2022.03.08/base-machine/manual/install/install_machine diff --git a/seed/applicationservice/2022.03.08/base/manual/install/install_machines b/seed/applicationservice/2022.03.08/base-machine/manual/install/install_machines similarity index 100% rename from seed/applicationservice/2022.03.08/base/manual/install/install_machines rename to seed/applicationservice/2022.03.08/base-machine/manual/install/install_machines diff --git a/seed/applicationservice/2022.03.08/base/manual/install/make_changelog b/seed/applicationservice/2022.03.08/base-machine/manual/install/make_changelog similarity index 100% rename from seed/applicationservice/2022.03.08/base/manual/install/make_changelog rename to seed/applicationservice/2022.03.08/base-machine/manual/install/make_changelog diff --git a/seed/applicationservice/2022.03.08/base/manual/install/make_volatile b/seed/applicationservice/2022.03.08/base-machine/manual/install/make_volatile similarity index 100% rename from seed/applicationservice/2022.03.08/base/manual/install/make_volatile rename to seed/applicationservice/2022.03.08/base-machine/manual/install/make_volatile diff --git a/seed/applicationservice/2022.03.08/base/templates/locale.conf b/seed/applicationservice/2022.03.08/base-machine/templates/locale.conf similarity index 100% rename from seed/applicationservice/2022.03.08/base/templates/locale.conf rename to seed/applicationservice/2022.03.08/base-machine/templates/locale.conf diff --git a/seed/applicationservice/2022.03.08/base/applicationservice.yml b/seed/applicationservice/2022.03.08/base/applicationservice.yml index 029925ae..2daf18e8 100644 --- a/seed/applicationservice/2022.03.08/base/applicationservice.yml +++ b/seed/applicationservice/2022.03.08/base/applicationservice.yml @@ -1,2 +1,2 @@ format: '0.1' -description: Information de base d'un serveur +description: Base diff --git a/seed/applicationservice/2022.03.08/base/funcs/base.py b/seed/applicationservice/2022.03.08/base/funcs/base.py new file mode 100644 index 00000000..10a4031f --- /dev/null +++ b/seed/applicationservice/2022.03.08/base/funcs/base.py @@ -0,0 +1,9 @@ +from typing import List +from risotto.utils import load_domains, DOMAINS + + +def get_ip(server_name: str) -> str: + load_domains() + host_name, domain_name = server_name.split('.', 1) + domain = DOMAINS[domain_name] + return domain[1][domain[0].index(host_name)] diff --git a/seed/applicationservice/2022.03.08/dovecot/dictionaries/26_dovecot.xml b/seed/applicationservice/2022.03.08/dovecot/dictionaries/26_dovecot.xml index c711bea9..696623de 100644 --- a/seed/applicationservice/2022.03.08/dovecot/dictionaries/26_dovecot.xml +++ b/seed/applicationservice/2022.03.08/dovecot/dictionaries/26_dovecot.xml @@ -51,7 +51,7 @@ - + 587 993 diff --git a/seed/applicationservice/2022.03.08/gitea/dictionaries/31_gitea.xml b/seed/applicationservice/2022.03.08/gitea/dictionaries/31_gitea.xml index 8855276f..812ea94e 100644 --- a/seed/applicationservice/2022.03.08/gitea/dictionaries/31_gitea.xml +++ b/seed/applicationservice/2022.03.08/gitea/dictionaries/31_gitea.xml @@ -10,7 +10,7 @@ - + 2222 diff --git a/seed/applicationservice/2022.03.08/host-systemd-machined/applicationservice.yml b/seed/applicationservice/2022.03.08/host-systemd-machined/applicationservice.yml index d8ff0c1f..747473a7 100644 --- a/seed/applicationservice/2022.03.08/host-systemd-machined/applicationservice.yml +++ b/seed/applicationservice/2022.03.08/host-systemd-machined/applicationservice.yml @@ -1,2 +1,4 @@ format: '0.1' description: Configure Systemd Machined +depends: + - base diff --git a/seed/applicationservice/2022.03.08/host-systemd-machined/dictionaries/21-machined.xml b/seed/applicationservice/2022.03.08/host-systemd-machined/dictionaries/21-machined.xml index 161a535d..9e19a522 100644 --- a/seed/applicationservice/2022.03.08/host-systemd-machined/dictionaries/21-machined.xml +++ b/seed/applicationservice/2022.03.08/host-systemd-machined/dictionaries/21-machined.xml @@ -8,6 +8,8 @@ systemd_zone_filename systemd_netzone_filename + + /tmpfiles.d/0asystemd-nspawn.conf /etc/systemd/system/systemd-nspawn@.service.d/systemd-nspawn@.conf diff --git a/seed/applicationservice/2022.03.08/host-systemd-machined/doc.md b/seed/applicationservice/2022.03.08/host-systemd-machined/doc.md index c859c38a..4686184d 100644 --- a/seed/applicationservice/2022.03.08/host-systemd-machined/doc.md +++ b/seed/applicationservice/2022.03.08/host-systemd-machined/doc.md @@ -2,7 +2,7 @@ Providers ========= - machines : nom de domaine des machines (au sens systemd-machined) exécuté sur l'hôte (c'est une variable multiple). Cette variable est une variable meneuse, les variables suivantes sont des variables suiveuses. -- external_ports : ports rendu accessible depuis l'extérieur (cette variable est multiple). +- incoming_ports : ports rendu accessible depuis l'extérieur (cette variable est multiple). - machine_srv : répertoire contenant le répertoire /srv de la machine (cette variable n'est pas obligatoire). - marchine_journal : répertoire contenant le répertoire /var/log/journal de la machine. - machine_config : répertoire contenant le répertoire /usr/local/lib de la machine. diff --git a/seed/applicationservice/2022.03.08/host-systemd-machined/extras/machined/00-machined.xml b/seed/applicationservice/2022.03.08/host-systemd-machined/extras/machined/00-machined.xml index 3b1449d6..c75f73d9 100644 --- a/seed/applicationservice/2022.03.08/host-systemd-machined/extras/machined/00-machined.xml +++ b/seed/applicationservice/2022.03.08/host-systemd-machined/extras/machined/00-machined.xml @@ -9,7 +9,8 @@ -