manage firewall for host
This commit is contained in:
Emmanuel Garette
parent
3f631b1d5b
commit
41c8b44bd1
34 changed files with 71 additions and 29 deletions
|
|
@ -1,5 +1,5 @@
|
|||
format: '0.1'
|
||||
description: Information de base d'un serveur Debian
|
||||
depends:
|
||||
- base
|
||||
- base-machine
|
||||
- systemd
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
format: '0.1'
|
||||
description: Information de base d'un serveur Fedora
|
||||
depends:
|
||||
- base
|
||||
- base-machine
|
||||
- systemd
|
||||
|
|
|
|||
|
|
@ -8,4 +8,3 @@ ExecStart=/usr/bin/update-ca-trust
|
|||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,4 @@
|
|||
format: '0.1'
|
||||
description: Base information for a machine
|
||||
depends:
|
||||
- base
|
||||
|
|
@ -46,8 +46,6 @@
|
|||
</fill>
|
||||
<fill name="get_ip">
|
||||
<param name="server_name" type="information">server_name</param>
|
||||
<param name="zones_name" type="information">zones_name</param>
|
||||
<param name="index" type="suffix"/>
|
||||
<target>ip_eth</target>
|
||||
</fill>
|
||||
<!-- Return "server_name" only for domain_name_eth0 -->
|
||||
|
|
@ -1,5 +1,4 @@
|
|||
import __main__
|
||||
from typing import List
|
||||
from secrets import token_urlsafe as _token_urlsafe, token_hex as _token_hex
|
||||
from string import ascii_letters as _ascii_letters
|
||||
from random import choice as _choice
|
||||
|
|
@ -7,7 +6,7 @@ from os.path import dirname as _dirname, abspath as _abspath, join as _join, isf
|
|||
from os import makedirs as _makedirs
|
||||
|
||||
|
||||
from risotto.utils import load_domains, DOMAINS, ZONES_SERVER
|
||||
from risotto.utils import ZONES_SERVER
|
||||
|
||||
|
||||
_HERE = _dirname(_abspath(__main__.__file__))
|
||||
|
|
@ -103,16 +102,6 @@ def get_domain_name(server_name: str,
|
|||
return extra_domainnames[index - 1]
|
||||
|
||||
|
||||
def get_ip(server_name: str,
|
||||
zones_name: List[str],
|
||||
index: str,
|
||||
) -> str:
|
||||
load_domains()
|
||||
host_name, domain_name = server_name.split('.', 1)
|
||||
domain = DOMAINS[domain_name]
|
||||
return domain[1][domain[0].index(host_name)]
|
||||
|
||||
|
||||
def get_provider_name(network_name: str,
|
||||
provider: str,
|
||||
) -> str:
|
||||
|
|
@ -1,2 +1,2 @@
|
|||
format: '0.1'
|
||||
description: Information de base d'un serveur
|
||||
description: Base
|
||||
|
|
|
|||
9
seed/applicationservice/2022.03.08/base/funcs/base.py
Normal file
9
seed/applicationservice/2022.03.08/base/funcs/base.py
Normal file
|
|
@ -0,0 +1,9 @@
|
|||
from typing import List
|
||||
from risotto.utils import load_domains, DOMAINS
|
||||
|
||||
|
||||
def get_ip(server_name: str) -> str:
|
||||
load_domains()
|
||||
host_name, domain_name = server_name.split('.', 1)
|
||||
domain = DOMAINS[domain_name]
|
||||
return domain[1][domain[0].index(host_name)]
|
||||
|
|
@ -51,7 +51,7 @@
|
|||
</services>
|
||||
<variables>
|
||||
<family name="network">
|
||||
<variable name="external_ports" redefine="True">
|
||||
<variable name="incoming_ports" redefine="True">
|
||||
<value>587</value>
|
||||
<value>993</value>
|
||||
</variable>
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@
|
|||
</services>
|
||||
<variables>
|
||||
<family name="network">
|
||||
<variable name="external_ports" redefine="True">
|
||||
<variable name="incoming_ports" redefine="True">
|
||||
<value>2222</value>
|
||||
</variable>
|
||||
</family>
|
||||
|
|
|
|||
|
|
@ -1,2 +1,4 @@
|
|||
format: '0.1'
|
||||
description: Configure Systemd Machined
|
||||
depends:
|
||||
- base
|
||||
|
|
|
|||
|
|
@ -8,6 +8,8 @@
|
|||
<file file_type="variable" source="70-container.network" variable="zone_name">systemd_zone_filename</file>
|
||||
<file file_type="variable" source="70-container.netdev" variable="zone_name">systemd_netzone_filename</file>
|
||||
</service>
|
||||
<service name="risottofirewall" engine="creole" target="multi-user">
|
||||
</service>
|
||||
<service name="systemd-nspawn@">
|
||||
<file>/tmpfiles.d/0asystemd-nspawn.conf</file>
|
||||
<file>/etc/systemd/system/systemd-nspawn@.service.d/systemd-nspawn@.conf</file>
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@ Providers
|
|||
=========
|
||||
|
||||
- machines : nom de domaine des machines (au sens systemd-machined) exécuté sur l'hôte (c'est une variable multiple). Cette variable est une variable meneuse, les variables suivantes sont des variables suiveuses.
|
||||
- external_ports : ports rendu accessible depuis l'extérieur (cette variable est multiple).
|
||||
- incoming_ports : ports rendu accessible depuis l'extérieur (cette variable est multiple).
|
||||
- machine_srv : répertoire contenant le répertoire /srv de la machine (cette variable n'est pas obligatoire).
|
||||
- marchine_journal : répertoire contenant le répertoire /var/log/journal de la machine.
|
||||
- machine_config : répertoire contenant le répertoire /usr/local/lib de la machine.
|
||||
|
|
|
|||
|
|
@ -9,7 +9,8 @@
|
|||
<variables>
|
||||
<variable name="machines" description="Machines started in this host" type="domainname" multi="True" provider="machines"/>
|
||||
<family name="machine_" description="Machine " dynamic="machined.machines">
|
||||
<variable name="external_ports_" description="External ports for " hidden="True" type="port" multi="True" provider="external_ports"/>
|
||||
<variable name="incoming_ports_" description="Incomming external ports for " hidden="True" type="port" multi="True" provider="incoming_ports"/>
|
||||
<variable name="outgoing_ports_" description="Outcoming external ports for " hidden="True" type="port" multi="True" provider="outgoing_ports"/>
|
||||
<variable name="srv_dir_" description="Directory with srv volume for " hidden="True" type="filename" provider="machine_srv"/>
|
||||
<variable name="journal_dir_" description="Directory with journal volume for " hidden="True" type="filename" provider="machine_journal"/>
|
||||
<variable name="config_dir_" description="Directory with configuration volume for " hidden="True" type="filename" provider="machine_config" mandatory="True"/>
|
||||
|
|
|
|||
|
|
@ -23,6 +23,6 @@ VirtualEthernetExtra=%%intname[:15]:host%%idx
|
|||
%end if
|
||||
%end for
|
||||
%end if
|
||||
%for %%port in %%container['external_ports_' + %%name]
|
||||
%for %%port in %%container['incoming_ports_' + %%name]
|
||||
Port=tcp:%%port:%%port
|
||||
%end for
|
||||
|
|
|
|||
|
|
@ -0,0 +1,24 @@
|
|||
[Unit]
|
||||
Description=Firewall for Risotto
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
%for %%dns in %%machined.machines
|
||||
%set %%machine = %%normalize_family(%%dns)
|
||||
%set %%outgoing = %%machined['machine_' + %%machine]['outgoing_ports_' + %%machine]
|
||||
%if %%outgoing
|
||||
%for %%port in %%outgoing
|
||||
%if ':' in %%port
|
||||
%set %%protocol, %%port = %%port.split(':')
|
||||
%else
|
||||
%set %%protocol = 'tcp'
|
||||
%end if
|
||||
ExecStart=/sbin/iptables -t nat -A POSTROUTING -s %%get_ip(%%dns) -p %%protocol -m %%protocol --dport %%port -o enp3s0 -j MASQUERADE
|
||||
ExecStop=-/sbin/iptables -t nat -D POSTROUTING -s %%get_ip(%%dns) -p %%protocol -m %%protocol --dport %%port -o enp3s0 -j MASQUERADE
|
||||
%end for
|
||||
%end if
|
||||
%end for
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
|
@ -11,7 +11,7 @@
|
|||
</services>
|
||||
<variables>
|
||||
<family name="network">
|
||||
<variable name="external_ports" redefine="True">
|
||||
<variable name="incoming_ports" redefine="True">
|
||||
<value>80</value>
|
||||
<value>443</value>
|
||||
</variable>
|
||||
|
|
|
|||
|
|
@ -34,7 +34,10 @@
|
|||
<variables>
|
||||
<family name="network">
|
||||
<variable name="dns_client_address" redefine="True"/>
|
||||
<variable name="external_ports" redefine="True">
|
||||
<variable name="outgoing_ports" redefine="True">
|
||||
<value>25</value>
|
||||
</variable>
|
||||
<variable name="incoming_ports" redefine="True">
|
||||
<value>25</value>
|
||||
</variable>
|
||||
</family>
|
||||
|
|
|
|||
|
|
@ -26,7 +26,8 @@
|
|||
<value>False</value>
|
||||
</variable>
|
||||
<family name="network">
|
||||
<variable name="external_ports" type="port" description="Ports exposés depuis l'extérieur" multi="True"/>
|
||||
<variable name="incoming_ports" type="port" description="Ports exposés depuis l'extérieur" multi="True"/>
|
||||
<variable name="outgoing_ports" type="port" description="Ports autorisés vers l'extérieur" multi="True"/>
|
||||
<variable name="netwokd_interface_name_type" redefine="True">
|
||||
<value>host</value>
|
||||
</variable>
|
||||
|
|
@ -65,9 +66,15 @@
|
|||
</check>
|
||||
<check name="set_linked_configuration">
|
||||
<param name="linked_server" type="variable">host</param>
|
||||
<param name="linked_provider">external_ports</param>
|
||||
<param name="linked_provider">incoming_ports</param>
|
||||
<param name="dynamic" type="variable">domain_name_eth0</param>
|
||||
<target>external_ports</target>
|
||||
<target>incoming_ports</target>
|
||||
</check>
|
||||
<check name="set_linked_configuration">
|
||||
<param name="linked_server" type="variable">host</param>
|
||||
<param name="linked_provider">outgoing_ports</param>
|
||||
<param name="dynamic" type="variable">domain_name_eth0</param>
|
||||
<target>outgoing_ports</target>
|
||||
</check>
|
||||
<check name="set_linked_configuration">
|
||||
<param name="linked_server" type="variable">host</param>
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
format: '0.1'
|
||||
description: Configuration de systemd
|
||||
depends:
|
||||
- base
|
||||
- base-machine
|
||||
|
|
|
|||
|
|
@ -19,6 +19,10 @@
|
|||
<family name="network">
|
||||
<variable name="dns_client_address" redefine="True" disabled="True"/>
|
||||
<variable name="ip_dns" redefine="True" remove_fill="True"/>
|
||||
<variable name="outgoing_ports" redefine="True">
|
||||
<value>udp:53</value>
|
||||
<value>53</value>
|
||||
</variable>
|
||||
</family>
|
||||
<family name='dns_resolver' description='Résolveur DNS'>
|
||||
<variable name="unbound_allowed_client" type="ip" description="Réseau des clients autorisés à faire des requêtes DNS" multi="True" mandatory="True" provider="dns"/>
|
||||
|
|
|
|||
Loading…
Reference in a new issue