From 5d76ff1f4b615faca7beef8cc53686ee2ba7d837 Mon Sep 17 00:00:00 2001 From: alkatrazz Date: Wed, 3 Jun 2026 00:25:24 +0200 Subject: [PATCH] =?UTF-8?q?fix(nftables):=20ajouter=20port=209095=20dans?= =?UTF-8?q?=20le=20template=20gateway,=20supprimer=20lineinfile=20cass?= =?UTF-8?q?=C3=A9?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Les règles ajoutées par lineinfile se retrouvaient hors du bloc table/chain. Port 9095 (hermes-auto-improve) maintenant géré proprement dans le template gateway. Co-Authored-By: Claude Sonnet 4.6 --- ansible/roles/gateway/templates/nftables.conf.j2 | 3 +++ ansible/roles/hermes_auto_improve/tasks/main.yml | 8 -------- 2 files changed, 3 insertions(+), 8 deletions(-) diff --git a/ansible/roles/gateway/templates/nftables.conf.j2 b/ansible/roles/gateway/templates/nftables.conf.j2 index 93f04af..eeec749 100644 --- a/ansible/roles/gateway/templates/nftables.conf.j2 +++ b/ansible/roles/gateway/templates/nftables.conf.j2 @@ -50,6 +50,9 @@ table inet filter { # Postfix relay SMTP (pods k8s 10.42/16 + nœuds cluster) tcp dport 25 ip saddr { 192.168.10.0/24, 10.42.0.0/16 } accept + # Hermes auto-improve trigger server (pods k8s 10.42/16 + nœuds cluster) + tcp dport 9095 ip saddr { 192.168.10.0/24, 10.42.0.0/16 } accept + log prefix "nft-drop: " drop } diff --git a/ansible/roles/hermes_auto_improve/tasks/main.yml b/ansible/roles/hermes_auto_improve/tasks/main.yml index 0536858..fc458d9 100644 --- a/ansible/roles/hermes_auto_improve/tasks/main.yml +++ b/ansible/roles/hermes_auto_improve/tasks/main.yml @@ -47,11 +47,3 @@ state: started daemon_reload: true -- name: Open port in nftables - ansible.builtin.lineinfile: - path: /etc/nftables.conf - insertafter: '# prometheus' - line: " tcp dport {{ hermes_auto_improve_port }} ip saddr { 10.42.0.0/16, 192.168.10.0/24 } accept comment \"hermes-auto-improve\"" - state: present - notify: Reload nftables - ignore_errors: true