pez-infra/ansible/inventory/host_vars/nuremberg-a.yml at 339c08c5c2dc361aee8172326afcb70d539951a9 - RWejlgaard/pez-infra - Forgejo

RWejlgaard/pez-infra

mirror of https://github.com/RWejlgaard/pez-infra.git synced 2026-05-06 04:14:43 +00:00

Rasmus Wejlgaard 339c08c5c2 Configure UFW firewall rules in common Ansible role

Add UFW configuration to the common role for Debian hosts:
- Default deny incoming, allow outgoing
- Allow all traffic on tailscale0 interface (mesh comms)
- Allow SSH port 22 as safety net
- Per-host allowed ports via ufw_allowed_ports variable
- Enable UFW after rules are applied

helsinki-a gets ports 80/443 for reverse proxy traffic.
Other Debian hosts only need Tailscale + SSH.

Closes PESO-79

2026-03-29 09:07:42 +00:00

7 lines

270 B

YAML

Raw Blame History

 ---
 host_role: mail
 host_description: "Mail server (poste.io)"
 host_location: "Hetzner Cloud"
 ansible_python_interpreter: /usr/bin/python3
 # NOTE: Alpine host — UFW tasks are Debian-only.
 # Firewall rules for mail ports (25,465,587,993,143,80,443) managed separately.