From c4b79775af2f66248c8bb75208b1085897453299 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Murat=20=C3=96ZDEM=C4=B0R?= Date: Fri, 26 Jun 2026 22:05:01 +0300 Subject: [PATCH] feat(ansible): allow ICMP from Uptime Kuma monitoring server via firewalld rich rule --- ansible/prod/group_vars/all/vars.yml | 1 + ansible/roles/hardening/tasks/main.yml | 10 ++++++++++ ansible/test/group_vars/all/vars.yml | 1 + 3 files changed, 12 insertions(+) diff --git a/ansible/prod/group_vars/all/vars.yml b/ansible/prod/group_vars/all/vars.yml index c7db130..6306dca 100644 --- a/ansible/prod/group_vars/all/vars.yml +++ b/ansible/prod/group_vars/all/vars.yml @@ -36,6 +36,7 @@ act_runner_labels: "prod-runner:docker://catthehacker/ubuntu:act-22.04,ubuntu-24 swarm_manager_ip: "10.20.10.11" mongodb_replset_name: "rs0" admin_allowed_cidrs: "78.187.87.109/32 95.70.151.248/32 188.3.184.2/32" +monitoring_allowed_cidrs: "91.99.57.252/32" admin_ssh_public_keys: - "{{ lookup('file', 'files/keys/murat_ozdemir.pub') }}" - "{{ lookup('file', 'files/keys/bimetri_dev1.pub') }}" diff --git a/ansible/roles/hardening/tasks/main.yml b/ansible/roles/hardening/tasks/main.yml index 4dbe1e2..86be604 100644 --- a/ansible/roles/hardening/tasks/main.yml +++ b/ansible/roles/hardening/tasks/main.yml @@ -59,6 +59,16 @@ immediate: yes loop: "{{ admin_allowed_cidrs.split(' ') }}" +- name: Allow ICMP from monitoring server in firewalld + ansible.posix.firewalld: + rich_rule: 'rule family="ipv4" source address="{{ item }}" protocol value="icmp" accept' + zone: drop + state: enabled + permanent: yes + immediate: yes + loop: "{{ monitoring_allowed_cidrs.split(' ') }}" + when: monitoring_allowed_cidrs is defined + - name: Configure firewalld default zone ansible.builtin.shell: firewall-cmd --set-default-zone=drop changed_when: false diff --git a/ansible/test/group_vars/all/vars.yml b/ansible/test/group_vars/all/vars.yml index c30e07d..3f2587a 100644 --- a/ansible/test/group_vars/all/vars.yml +++ b/ansible/test/group_vars/all/vars.yml @@ -27,6 +27,7 @@ storagebox_managed_directories: iklim_password: "{{ vault_iklim_password }}" swarm_manager_ip: "10.10.10.11" admin_allowed_cidrs: "78.187.87.109/32 95.70.151.248/32" +monitoring_allowed_cidrs: "91.99.57.252/32" admin_ssh_public_key_path: "~/.ssh/id_rsa.pub" timezone: "Europe/Istanbul"