d715244b76
Idempotent host configuration targeting Ubuntu 24.04 with ZFS on a dedicated second disk. Role-based platform-infra/ansible: - base: apt packages, timezone, unattended security upgrades. - zfs: install ZFS, create pool on a dedicated disk (guarded against wiping a non-empty disk), create platform datasets + customers parent per docs/03; docker dataset mounted at /var/lib/docker. - docker: Docker Engine + Compose plugin, daemon.json written before first start so the native zfs storage driver initializes on the ZFS data-root; per-site network address pool preconfigured. - firewall: nftables inbound default-deny in a dedicated table that never flushes Docker's rules; container outbound SMTP blocked via a DOCKER-USER jump applied by a systemd oneshot. - ssh_hardening: key-first SSH with an anti-lockout assertion, config validation gate, and the sftponly group for Phase 4 SFTP accounts. Includes ansible.cfg, requirements.yml, inventory example, group_vars with safety notes, and a run guide. Real inventory (hosts.yml) is git-ignored. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
37 lines
1.3 KiB
Django/Jinja
37 lines
1.3 KiB
Django/Jinja
#!/usr/bin/env bash
|
|
# heleos: block outbound SMTP from containers (spam prevention from hacked sites).
|
|
# Managed by Ansible. Implemented as a dedicated chain jumped from DOCKER-USER,
|
|
# which Docker evaluates before its own FORWARD rules. Idempotent on re-run.
|
|
set -euo pipefail
|
|
|
|
PORTS="{{ smtp_blocked_ports | join(',') }}"
|
|
RELAY="{{ smtp_relay_host }}"
|
|
|
|
# DOCKER-USER only exists once the Docker daemon has set up networking. Wait for it.
|
|
for _ in $(seq 1 30); do
|
|
if iptables -L DOCKER-USER -n >/dev/null 2>&1; then
|
|
break
|
|
fi
|
|
sleep 1
|
|
done
|
|
|
|
# (Re)build our chain from scratch.
|
|
iptables -N HELEOS-EGRESS 2>/dev/null || true
|
|
iptables -F HELEOS-EGRESS
|
|
|
|
# Let established/return traffic through fast.
|
|
iptables -A HELEOS-EGRESS -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
|
|
|
|
{% if smtp_relay_host | length > 0 %}
|
|
# Permit SMTP only to the approved relay.
|
|
iptables -A HELEOS-EGRESS -p tcp -d "${RELAY}" -m multiport --dports "${PORTS}" -j RETURN
|
|
{% endif %}
|
|
|
|
# Reject all other outbound SMTP.
|
|
iptables -A HELEOS-EGRESS -p tcp -m multiport --dports "${PORTS}" \
|
|
-j REJECT --reject-with icmp-admin-prohibited
|
|
|
|
# Ensure DOCKER-USER jumps into our chain exactly once.
|
|
if ! iptables -C DOCKER-USER -j HELEOS-EGRESS 2>/dev/null; then
|
|
iptables -I DOCKER-USER -j HELEOS-EGRESS
|
|
fi
|