- Implemented samba service

- Improved firewall rules

ansible/host_vars/dev-01.alexpires.dev.yml

@@ -18,8 +18,9 @@ login_users:
 # SSH Connection and security
 sshd_port: 22
 ssh_allowed_networks:
-  - "0.0.0.0/0"
-sshd_admin_net: "0.0.0.0/0"
+  - "10.5.5.5/32" # Wireguard VPN (Laptop)
+  - "10.19.4.0/24" # local network
+sshd_admin_net: "10.19.4.0/24" # local network
 sshd_allow_groups: "{{ ansible_user }} users"
 sshd_permit_root_login: "no"
 sshd_password_authentication: "no"
@@ -31,8 +32,13 @@ sshd_max_auth_tries: 10
 # Firewall ports
 ufw_enable: true
 fw_allowed_ports:
-  - { rule: "allow", port: "22", proto: "tcp" }
-  - { rule: "allow", port: "443", proto: "tcp" }
+  - { rule: "allow", port: "22", proto: "tcp", from: "10.5.5.5/32" } # Wireguard VPN (Laptop)
+  - { rule: "allow", port: "22", proto: "tcp", from: "10.19.4.0/24" } # local network
+  - { rule: "allow", port: "16443", proto: "tcp", from: "10.5.5.5/32" } # Kubernetes API (Laptop)
+  - { rule: "allow", port: "16443", proto: "tcp", from: "10.19.4.0/24" } # Kubernetes API (local network)
+  - { rule: "allow", port: "139", proto: "tcp", from: "10.19.4.0/24" } # Samba (local network)
+  - { rule: "allow", port: "445", proto: "tcp", from: "10.19.4.0/24" } # Samba (local network)
+  - { rule: "allow", port: "443", proto: "tcp", from: "10.5.5.2/32" } # Wireguard VPN (Kokoro-FastAPI)
 
 ufw_outgoing_traffic:
   - 22 # SSH
@@ -73,6 +79,24 @@ fail2ban_jails:
 # aide
 install_aide: false
 
+misc_modules_blocklist:
+  - bluetooth
+  - bnep
+  - btusb
+  - can
+  - cpia2
+  - firewire-core
+  - floppy
+  - ksmbd
+  - n_hdlc
+  - net-pf-31
+  - pcspkr
+  - soundcore
+  - thunderbolt
+  - usb-midi
+  - uvcvideo
+  - v4l2_common
+
 # Unattended upgrades
 unattended_reboot: true
 unattended_reboot_time: "04:30"