d715244b76
Idempotent host configuration targeting Ubuntu 24.04 with ZFS on a dedicated second disk. Role-based platform-infra/ansible: - base: apt packages, timezone, unattended security upgrades. - zfs: install ZFS, create pool on a dedicated disk (guarded against wiping a non-empty disk), create platform datasets + customers parent per docs/03; docker dataset mounted at /var/lib/docker. - docker: Docker Engine + Compose plugin, daemon.json written before first start so the native zfs storage driver initializes on the ZFS data-root; per-site network address pool preconfigured. - firewall: nftables inbound default-deny in a dedicated table that never flushes Docker's rules; container outbound SMTP blocked via a DOCKER-USER jump applied by a systemd oneshot. - ssh_hardening: key-first SSH with an anti-lockout assertion, config validation gate, and the sftponly group for Phase 4 SFTP accounts. Includes ansible.cfg, requirements.yml, inventory example, group_vars with safety notes, and a run guide. Real inventory (hosts.yml) is git-ignored. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
28 lines
932 B
Django/Jinja
28 lines
932 B
Django/Jinja
#!/usr/sbin/nft -f
|
|
# heleos host inbound firewall — managed by Ansible. Do not edit by hand.
|
|
#
|
|
# We own ONLY the `inet heleos` table. The delete-then-create pattern makes
|
|
# re-applying idempotent and never touches Docker's ip/ip6 filter+nat tables.
|
|
|
|
table inet heleos {}
|
|
delete table inet heleos
|
|
|
|
table inet heleos {
|
|
chain input {
|
|
type filter hook input priority filter; policy drop;
|
|
|
|
ct state established,related accept
|
|
ct state invalid drop
|
|
iif "lo" accept
|
|
|
|
# ICMP / ICMPv6 (ping + path-MTU discovery)
|
|
ip protocol icmp accept
|
|
ip6 nexthdr ipv6-icmp accept
|
|
|
|
# Admin SSH + public web ports
|
|
tcp dport { {{ ssh_port }}{% for p in firewall_allowed_tcp_ports %}, {{ p }}{% endfor %} } accept
|
|
}
|
|
}
|
|
|
|
# Container FORWARD/NAT (east-west isolation + egress) is handled by Docker in
|
|
# its own tables plus the heleos-docker-egress service. See the firewall role.
|