ufw

create-senora.yml

@@ -22,4 +22,5 @@
   roles:
    - ssh
    - common
+   - ufw_user
    - ambiente_consultorio

roles/common/tasks/main.yml

@@ -1,6 +1,7 @@
 - name: Install common packages
   apt: name={{item}} state=present
   with_items:
+    - ufw
     - unattended-upgrades
     - htop
     - sudo

roles/create-droplet/tasks/main.yml

@@ -8,18 +8,23 @@
     region_id=nyc1
     image_id=debian-8-x64
     ssh_key_ids={{ desktap.ssh_key.id }}
+    private_networking=yes
   with_items: "{{ droplets }}"
   register: droplet_details
 
   #- debug: msg="IP is {{ item['droplet']['ip_address'] }}, ID is {{ item['droplet']['id']}}."
   #  with_items: "{{ droplet_details.results }}"
 
+- name: Save IP/ID/Group to file
+  local_action: copy content="{{ item['droplet']['ip_address'] }}" dest="/tmp/outfile{{item['droplet']['name']}}"
+  with_items: "{{ droplet_details.results }}"
+
 - name: Add new droplet to host group
   local_action: add_host hostname={{ item['droplet']['ip_address'] }} groupname={{ dogroupname }}
   with_items: "{{ droplet_details.results }}"
 
 - name: Wait for SSH to come up
-  local_action: wait_for host={{ item['droplet']['ip_address'] }} port=22 delay=10 timeout=320 state=started           
+  local_action: wait_for host={{ item['droplet']['ip_address'] }} port=22 delay=5 timeout=320 state=started           
   with_items: "{{ droplet_details.results }}"
 
 - name: Keyscan droplets

roles/ufw_user/tasks/main.yml

@@ -0,0 +1,17 @@
+- name: Configure ufw defaults
+  ufw: direction={{ item.direction }} policy={{ item.policy }}
+  with_items:
+    - { direction: 'incoming', policy: 'deny' }
+    - { direction: 'outgoing', policy: 'allow' }
+
+- name: Allow (limit) ssh
+  ufw: rule=limit port=22 proto=tcp
+
+- name: Allow backend access (fixme local?)
+  ufw: rule=allow port=8000:8100 proto=tcp from="{{item}}"
+  with_items:
+    - 198.199.89.228
+    - 198.211.98.40
+
+- name: Enable ufw
+  ufw: state=enabled