You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
71 lines
1.8 KiB
71 lines
1.8 KiB
4 years ago
|
---
|
||
|
|
|
||
|
|
- name: Install needed tools
|
||
|
|
package:
|
||
|
|
name:
|
||
|
|
- ipset
|
||
|
|
tags: cs
|
||
|
|
|
||
|
|
- when: cs_fw_install_mode != 'none'
|
||
|
|
block:
|
||
|
|
|
||
|
|
- name: Download the bouncer
|
||
|
|
get_url:
|
||
|
|
url: "{{ cs_fw_archive_url }}"
|
||
|
|
dest: /tmp
|
||
|
|
checksum: sha1:{{ cs_fw_archive_sha1 }}
|
||
|
|
|
||
|
|
- name: Extract the archive
|
||
|
|
unarchive:
|
||
|
|
src: /tmp/cs-firewall-bouncer.tgz
|
||
|
|
dest: /tmp
|
||
|
|
remote_src: True
|
||
|
|
|
||
|
|
- name: Install or upgrade
|
||
|
|
command: ./{{ cs_fw_install_mode }}.sh
|
||
|
|
args:
|
||
|
|
chdir: /tmp/cs-firewall-bouncer-v{{ cs_fw_version }}
|
||
|
|
notify: restart cs-firewall-bouncer
|
||
|
|
|
||
|
|
tags: cs
|
||
|
|
|
||
|
|
- name: Create systemd unit snippet dir
|
||
|
|
file: path=/etc/systemd/system/cs-firewall-bouncer.service.d state=directory
|
||
|
|
tags: cs
|
||
|
|
|
||
|
|
- name: Create iptables snippet dir
|
||
|
|
file: path=/etc/systemd/system/{{ cs_iptables_service }}.service.d state=directory
|
||
|
|
tags: cs
|
||
|
|
|
||
|
|
- name: Create ipsets before iptables starts
|
||
|
|
copy:
|
||
|
|
content: |
|
||
|
|
[Service]
|
||
|
|
ExecStartPre=/usr/sbin/ipset -exist create crowdsec-blacklists nethash timeout 300
|
||
|
|
ExecStartPre=/usr/sbin/ipset -exist create crowdsec6-blacklists nethash timeout 300 family inet6
|
||
|
|
dest: /etc/systemd/system/{{ cs_iptables_service }}.service.d/cs-ipset.conf
|
||
|
|
register: cs_iptable_unit
|
||
|
|
tags: cs
|
||
|
|
|
||
|
|
- name: Tune cs-firewall-bouncer service
|
||
|
|
copy:
|
||
|
|
content: |
|
||
|
|
[Unit]
|
||
|
|
# The bouncer should start after crowdsec to be able to register on the API
|
||
|
|
After=crowdsec.service
|
||
|
|
|
||
|
|
[Service]
|
||
|
|
# Restart on failure
|
||
|
|
Restart=on-failure
|
||
|
|
StartLimitInterval=0
|
||
|
|
RestartSec=30
|
||
|
|
dest: /etc/systemd/system/cs-firewall-bouncer.service.d/ansible.conf
|
||
|
|
register: crodwsec_fw_unit
|
||
|
|
notify: restart cs-firewall-bouncer
|
||
|
|
tags: cs
|
||
|
|
|
||
|
|
- name: Reload systemd
|
||
|
|
systemd: daemon_reload=True
|
||
|
|
when: crodwsec_fw_unit.changed or cs_iptable_unit.changed
|
||
|
|
tags: cs
|