akadmin/Funk-lab
1
0
Fork 0
mirror of https://github.com/Alkatrazz24/Funk-lab.git synced 2026-07-08 12:44:41 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(nftables): ajouter port 9095 dans le template gateway, supprimer lineinfile cassé

Browse source 
Les règles ajoutées par lineinfile se retrouvaient hors du bloc table/chain.
Port 9095 (hermes-auto-improve) maintenant géré proprement dans le template gateway.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
alkatrazz 2026-06-03 00:25:24 +02:00
parent 3f9772c9d1
commit 5d76ff1f4b
2 changed files with 3 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

3
ansible/roles/gateway/templates/nftables.conf.j2
View file

@ -50,6 +50,9 @@ table inet filter {
# Postfix relay SMTP (pods k8s 10.42/16 + nœuds cluster)
tcp dport 25 ip saddr { 192.168.10.0/24, 10.42.0.0/16 } accept
# Hermes auto-improve trigger server (pods k8s 10.42/16 + nœuds cluster)
tcp dport 9095 ip saddr { 192.168.10.0/24, 10.42.0.0/16 } accept
log prefix "nft-drop: " drop
}

8
ansible/roles/hermes_auto_improve/tasks/main.yml
View file

@ -47,11 +47,3 @@
state: started
daemon_reload: true
- name: Open port in nftables
ansible.builtin.lineinfile:
path: /etc/nftables.conf
insertafter: '# prometheus'
line: " tcp dport {{ hermes_auto_improve_port }} ip saddr { 10.42.0.0/16, 192.168.10.0/24 } accept comment \"hermes-auto-improve\""
state: present
notify: Reload nftables
ignore_errors: true