70 lines
2.0 KiB
YAML
70 lines
2.0 KiB
YAML
---
|
|
- name: Configure firewall and SSH port
|
|
block:
|
|
- name: Fail if vmid is not defined
|
|
ansible.builtin.fail:
|
|
msg: "'vmid' must be defined to calculate dynamic SSH port"
|
|
when: vmid is not defined
|
|
|
|
- name: Calculate SSH port from vmid
|
|
ansible.builtin.set_fact:
|
|
ssh_port: "{{ 10000 + (vmid | int % 100) }}"
|
|
|
|
- name: Enable and start firewalld
|
|
ansible.builtin.service:
|
|
name: firewalld
|
|
state: started
|
|
enabled: true
|
|
|
|
- name: Set firewalld default zone to drop
|
|
ansible.posix.firewalld:
|
|
zone: public
|
|
state: enabled
|
|
permanent: yes
|
|
target: DROP
|
|
|
|
- name: Reload firewalld to apply permanent changes
|
|
ansible.builtin.command: firewall-cmd --reload
|
|
|
|
- name: Allow custom SSH port in firewalld
|
|
ansible.posix.firewalld:
|
|
port: "{{ ssh_port }}/tcp"
|
|
permanent: true
|
|
state: enabled
|
|
immediate: true
|
|
|
|
- name: Allow Endlessh port in firewalld
|
|
ansible.posix.firewalld:
|
|
port: "{{ endlessh_port }}/tcp"
|
|
permanent: true
|
|
state: enabled
|
|
immediate: true
|
|
|
|
- name: Ensure custom SSH port is set in sshd_config
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: '^#?Port\s+'
|
|
line: "Port {{ ssh_port }}"
|
|
backup: yes
|
|
validate: "/usr/sbin/sshd -T -f %s"
|
|
register: sshd_config_changed
|
|
|
|
- name: Gather SELinux facts
|
|
ansible.builtin.setup:
|
|
filter: ansible_selinux
|
|
|
|
- name: Allow SSH to use custom port in SELinux
|
|
ansible.builtin.command: >
|
|
semanage port -a -t ssh_port_t -p tcp {{ ssh_port }}
|
|
register: semanage_result
|
|
failed_when: semanage_result.rc not in [0, 1]
|
|
changed_when: semanage_result.rc == 0
|
|
when: ansible_selinux.status == "enabled"
|
|
|
|
- name: Restart and enable sshd service if needed
|
|
ansible.builtin.service:
|
|
name: sshd
|
|
state: restarted
|
|
enabled: true
|
|
when: sshd_config_changed is changed
|