feat(ansible): allow ICMP from Uptime Kuma monitoring server via firewalld rich rule

ansible/prod/group_vars/all/vars.yml

@@ -36,6 +36,7 @@ act_runner_labels: "prod-runner:docker://catthehacker/ubuntu:act-22.04,ubuntu-24
 swarm_manager_ip: "10.20.10.11"
 mongodb_replset_name: "rs0"
 admin_allowed_cidrs: "78.187.87.109/32 95.70.151.248/32 188.3.184.2/32"
+monitoring_allowed_cidrs: "91.99.57.252/32"
 admin_ssh_public_keys:
   - "{{ lookup('file', 'files/keys/murat_ozdemir.pub') }}"
   - "{{ lookup('file', 'files/keys/bimetri_dev1.pub') }}"

ansible/roles/hardening/tasks/main.yml

@@ -59,6 +59,16 @@
     immediate: yes
   loop: "{{ admin_allowed_cidrs.split(' ') }}"
 
+- name: Allow ICMP from monitoring server in firewalld
+  ansible.posix.firewalld:
+    rich_rule: 'rule family="ipv4" source address="{{ item }}" protocol value="icmp" accept'
+    zone: drop
+    state: enabled
+    permanent: yes
+    immediate: yes
+  loop: "{{ monitoring_allowed_cidrs.split(' ') }}"
+  when: monitoring_allowed_cidrs is defined
+
 - name: Configure firewalld default zone
   ansible.builtin.shell: firewall-cmd --set-default-zone=drop
   changed_when: false

ansible/test/group_vars/all/vars.yml

@@ -27,6 +27,7 @@ storagebox_managed_directories:
 iklim_password: "{{ vault_iklim_password }}"
 swarm_manager_ip: "10.10.10.11"
 admin_allowed_cidrs: "78.187.87.109/32 95.70.151.248/32"
+monitoring_allowed_cidrs: "91.99.57.252/32"
 admin_ssh_public_key_path: "~/.ssh/id_rsa.pub"
 timezone: "Europe/Istanbul"