alexpires.me/a13labs.infra
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

- Implemented samba service

Browse Source 
- Improved firewall rules
This commit is contained in:
Alexandre Pires
2025-06-06 23:49:38 +02:00
parent 3ea65f060f
commit d3b8aff1ae
13 changed files with 285 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ansible/host_vars/dev-01.alexpires.dev.yml
+28 -4
View File
@@ -18,8 +18,9 @@ login_users:
# SSH Connection and security
sshd_port: 22
ssh_allowed_networks:
- "0.0.0.0/0"
sshd_admin_net: "0.0.0.0/0"
- "10.5.5.5/32" # Wireguard VPN (Laptop)
- "10.19.4.0/24" # local network
sshd_admin_net: "10.19.4.0/24" # local network
sshd_allow_groups: "{{ ansible_user }} users"
sshd_permit_root_login: "no"
sshd_password_authentication: "no"
@@ -31,8 +32,13 @@ sshd_max_auth_tries: 10
# Firewall ports
ufw_enable: true
fw_allowed_ports:
- { rule: "allow", port: "22", proto: "tcp" }
- { rule: "allow", port: "443", proto: "tcp" }
- { rule: "allow", port: "22", proto: "tcp", from: "10.5.5.5/32" } # Wireguard VPN (Laptop)
- { rule: "allow", port: "22", proto: "tcp", from: "10.19.4.0/24" } # local network
- { rule: "allow", port: "16443", proto: "tcp", from: "10.5.5.5/32" } # Kubernetes API (Laptop)
- { rule: "allow", port: "16443", proto: "tcp", from: "10.19.4.0/24" } # Kubernetes API (local network)
- { rule: "allow", port: "139", proto: "tcp", from: "10.19.4.0/24" } # Samba (local network)
- { rule: "allow", port: "445", proto: "tcp", from: "10.19.4.0/24" } # Samba (local network)
- { rule: "allow", port: "443", proto: "tcp", from: "10.5.5.2/32" } # Wireguard VPN (Kokoro-FastAPI)
ufw_outgoing_traffic:
- 22 # SSH
@@ -73,6 +79,24 @@ fail2ban_jails:
# aide
install_aide: false
misc_modules_blocklist:
- bluetooth
- bnep
- btusb
- can
- cpia2
- firewire-core
- floppy
- ksmbd
- n_hdlc
- net-pf-31
- pcspkr
- soundcore
- thunderbolt
- usb-midi
- uvcvideo
- v4l2_common
# Unattended upgrades
unattended_reboot: true
unattended_reboot_time: "04:30"
ansible/host_vars/gpu-01.alexpires.dev.yml
+8 -5
View File
@@ -19,8 +19,9 @@ login_users:
# SSH Connection and security
sshd_port: 22
ssh_allowed_networks:
- "0.0.0.0/0"
sshd_admin_net: "0.0.0.0/0"
- "10.5.5.5/32" # Wireguard VPN (Laptop)
- "10.19.4.0/24" # local network
sshd_admin_net: "10.19.4.0/24" # local network
sshd_allow_groups: "{{ ansible_user }} users"
sshd_permit_root_login: "no"
sshd_password_authentication: "no"
@@ -34,9 +35,11 @@ packages_blocklist: []
# Firewall ports
ufw_enable: true
fw_allowed_ports:
- { rule: "allow", port: "22", proto: "tcp" }
- { rule: "allow", port: "11434", proto: "tcp" }
- { rule: "allow", port: "8880", proto: "tcp" }
- { rule: "allow", port: "22", proto: "tcp", from: "10.5.5.5/32" } # Wireguard VPN (Laptop)
- { rule: "allow", port: "22", proto: "tcp", from: "10.19.4.0/24" } # local network
- { rule: "allow", port: "11434", proto: "tcp", from: "10.19.4.0/24" } # Ollama (local network)
- { rule: "allow", port: "11434", proto: "tcp", from: "10.5.5.5/32" } # Ollama (Laptop)
- { rule: "allow", port: "8880", proto: "tcp", from: "10.19.4.0/24" } # Kokoro-FastAPI (local network)
ufw_outgoing_traffic:
- 22 # SSH
ansible/host_vars/prod-01.alexpires.me.yml
-4
View File
@@ -46,12 +46,8 @@ fw_allowed_ports:
- { rule: "allow", port: "21116", proto: "tcp" }
- { rule: "allow", port: "21116", proto: "udp" }
- { rule: "allow", port: "21117", proto: "tcp" }
- { rule: "allow", port: "16443", proto: "tcp", from: "10.1.0.0/16" }
- { rule: "allow", port: "10254", proto: "tcp", from: "10.1.0.0/16" }
# Access to the Kube API Server from the Office
- { rule: "allow", port: "16443", proto: "tcp", from: "188.82.170.183" }
# VPN to Portugal
- { rule: "allow", port: "10254", proto: "tcp", from: "147.78.131.194" }
ufw_outgoing_traffic:
- 22 # SSH
ansible/host_vars/vh-01.alexpires.dev.yml
+56 -12
View File
@@ -20,8 +20,9 @@ login_users:
# SSH Connection and security
sshd_port: 22
ssh_allowed_networks:
- "0.0.0.0/0"
sshd_admin_net: "0.0.0.0/0"
- "10.5.5.5/32" # Wireguard VPN (Laptop)
- "10.19.4.0/24" # local network
sshd_admin_net: "10.19.4.0/24" # local network
sshd_allow_groups: "{{ ansible_user }} users"
sshd_permit_root_login: "no"
sshd_password_authentication: "no"
@@ -33,7 +34,8 @@ sshd_max_auth_tries: 10
# Firewall ports
ufw_enable: true
fw_allowed_ports:
- { rule: "allow", port: "22", proto: "tcp" }
- { rule: "allow", port: "22", proto: "tcp", from: "10.5.5.5/32" } # Wireguard VPN (Laptop)
- { rule: "allow", port: "22", proto: "tcp", from: "10.19.4.0/24" } # local network
- { rule: "allow", port: "9090", proto: "tcp" }
ufw_outgoing_traffic:
@@ -76,9 +78,9 @@ virt_raw_block_devices:
- "nvme0n1p2"
virt_extra_grub_args: >
i915.modeset=1 i915.enable_gvt=1 i915.enable_fbc=0
initcall_blacklist=simpledrm_platform_driver_init
rd.driver.blacklist=nouveau modprobe.blacklist=nouveau
i915.modeset=1 i915.enable_gvt=1 i915.enable_fbc=0
initcall_blacklist=simpledrm_platform_driver_init
rd.driver.blacklist=nouveau modprobe.blacklist=nouveau
virt_vfio_ids:
- 10de:2482 # NVIDIA Corporation GA104 [GeForce RTX 3070 Ti]
@@ -120,7 +122,14 @@ virt_machines:
- type: "mdev"
source:
uuid: "5abeb24f-d6f4-4666-b495-303f15b05723"
address: { type: 'pci', domain: '0x0000', bus: '0x07', slot: '0x00', function: '0x0' }
address:
{
type: "pci",
domain: "0x0000",
bus: "0x07",
slot: "0x00",
function: "0x0",
}
# Fresco Logic FL1100 USB 3.0 Host Controller
- type: "pci"
source:
@@ -129,7 +138,14 @@ virt_machines:
bus: "0x06"
slot: "0x00"
function: "0x0"
address: { type: 'pci', domain: '0x0000', bus: '0x10', slot: '0x00', function: '0x0' }
address:
{
type: "pci",
domain: "0x0000",
bus: "0x10",
slot: "0x00",
function: "0x0",
}
# NVIDIA Corporation GA104 [GeForce RTX 3070 Ti]
- type: "pci"
source:
@@ -138,7 +154,14 @@ virt_machines:
bus: "0x01"
slot: "0x00"
function: "0x0"
address: { type: 'pci', domain: '0x0000', bus: '0x0b', slot: '0x00', function: '0x0' }
address:
{
type: "pci",
domain: "0x0000",
bus: "0x0b",
slot: "0x00",
function: "0x0",
}
# NVIDIA Corporation GA106 High Definition Audio Controller
- type: "pci"
source:
@@ -147,7 +170,14 @@ virt_machines:
bus: "0x01"
slot: "0x00"
function: "0x1"
address: { type: 'pci', domain: '0x0000', bus: '0x0f', slot: '0x00', function: '0x0' }
address:
{
type: "pci",
domain: "0x0000",
bus: "0x0f",
slot: "0x00",
function: "0x0",
}
- name: fedora-headless
title: "Fedora CUDA headless"
@@ -177,7 +207,14 @@ virt_machines:
bus: "0x03"
slot: "0x00"
function: "0x0"
address: { type: 'pci',domain: '0x0000',bus: '0x09',slot: '0x00',function: '0x0' }
address:
{
type: "pci",
domain: "0x0000",
bus: "0x09",
slot: "0x00",
function: "0x0",
}
# NVIDIA Corporation GA106 High Definition Audio Controller
- type: "pci"
source:
@@ -186,4 +223,11 @@ virt_machines:
bus: "0x03"
slot: "0x00"
function: "0x1"
address: { type: 'pci',domain: '0x0000',bus: '0x0a',slot: '0x00',function: '0x0' }
address:
{
type: "pci",
domain: "0x0000",
bus: "0x0a",
slot: "0x00",
function: "0x0",
}