mirror of
https://github.com/RWejlgaard/pez-infra.git
synced 2026-05-06 04:14:43 +00:00
Rasmus Wejlgaard
339c08c5c2
Add UFW configuration to the common role for Debian hosts: - Default deny incoming, allow outgoing - Allow all traffic on tailscale0 interface (mesh comms) - Allow SSH port 22 as safety net - Per-host allowed ports via ufw_allowed_ports variable - Enable UFW after rules are applied helsinki-a gets ports 80/443 for reverse proxy traffic. Other Debian hosts only need Tailscale + SSH. Closes PESO-79
15 lines
352 B
YAML
15 lines
352 B
YAML
---
|
|
host_role: proxy
|
|
host_description: "Reverse proxy (Caddy), main traffic gateway"
|
|
host_location: "Hetzner Cloud"
|
|
|
|
caddy_config_src: "{{ playbook_dir }}/services/caddy/Caddyfile"
|
|
|
|
docker_services:
|
|
- authelia
|
|
- forgejo
|
|
- bitwarden
|
|
|
|
ufw_allowed_ports:
|
|
- { port: 80, proto: tcp, comment: "HTTP" }
|
|
- { port: 443, proto: tcp, comment: "HTTPS" }
|