mirror of
https://github.com/Alkatrazz24/Funk-lab.git
synced 2026-07-08 12:54:43 +02:00
bb72145365
- Add talconfig.yaml with compute-01/02/03 (nvme0n1, Flannel CNI) - Add SOPS/age encryption for talsecret.sops.yaml - Add patches: NTP/DNS → storage-01, kubelet reserved for 8GB workers - Fix nftables: open DHCP port 67 for cluster LAN - Add dnsmasq DHCP with static leases for all 3 compute nodes - Add admin/talos.md: full install procedure + admin commands - Install kubectl + talosctl on storage-01 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
72 lines
2.3 KiB
Django/Jinja
72 lines
2.3 KiB
Django/Jinja
#!/usr/sbin/nft -f
|
|
# Géré par Ansible — ne pas modifier manuellement
|
|
|
|
flush ruleset
|
|
|
|
table inet filter {
|
|
chain input {
|
|
type filter hook input priority 0; policy drop;
|
|
|
|
# Loopback
|
|
iif lo accept
|
|
|
|
# Connexions établies
|
|
ct state established,related accept
|
|
|
|
# ICMP
|
|
ip protocol icmp accept
|
|
ip6 nexthdr icmpv6 accept
|
|
|
|
# SSH depuis le LAN domestique et le LAN cluster
|
|
tcp dport 22 ip saddr { 192.168.1.0/24, 192.168.10.0/24 } accept
|
|
|
|
# DNS + DHCP (dnsmasq)
|
|
udp dport 53 ip saddr 192.168.10.0/24 accept
|
|
tcp dport 53 ip saddr 192.168.10.0/24 accept
|
|
udp dport 67 iif {{ lan_interface }} accept
|
|
|
|
# NFS
|
|
tcp dport { 111, 2049 } ip saddr 192.168.10.0/24 accept
|
|
udp dport { 111, 2049 } ip saddr 192.168.10.0/24 accept
|
|
|
|
# Services données (accès cluster uniquement)
|
|
tcp dport { 5432, 6333, 6334, 9000, 9001 } ip saddr 192.168.10.0/24 accept
|
|
|
|
# Hermes gateway (accès LAN domestique + cluster)
|
|
tcp dport 8080 ip saddr { 192.168.1.0/24, 192.168.10.0/24 } accept
|
|
|
|
# Hermes dashboard (poste admin uniquement)
|
|
tcp dport 9119 ip saddr {{ hermes_dashboard_allowed_ip }} accept
|
|
|
|
# LiteLLM (localhost uniquement — pas d'accès réseau direct)
|
|
# Port 4000 non exposé ici intentionnellement
|
|
|
|
log prefix "nft-drop: " drop
|
|
}
|
|
|
|
chain forward {
|
|
type filter hook forward priority 0; policy drop;
|
|
|
|
# Forwarding LAN cluster → WAN (NAT sortant)
|
|
iif {{ lan_interface }} oif {{ wan_interface }} ct state new,established,related accept
|
|
|
|
# Forwarding LAN domestique → LAN cluster (accès admin depuis le poste perso)
|
|
iif {{ wan_interface }} oif {{ lan_interface }} ip saddr 192.168.1.0/24 ct state new,established,related accept
|
|
|
|
# Réponses WAN → cluster (connexions initiées depuis le cluster)
|
|
iif {{ wan_interface }} oif {{ lan_interface }} ct state established,related accept
|
|
}
|
|
|
|
chain output {
|
|
type filter hook output priority 0; policy accept;
|
|
}
|
|
}
|
|
|
|
table ip nat {
|
|
chain postrouting {
|
|
type nat hook postrouting priority 100;
|
|
|
|
# NAT masquerade pour le LAN cluster
|
|
oif {{ wan_interface }} ip saddr 192.168.10.0/24 masquerade
|
|
}
|
|
}
|