mirror of
https://github.com/zulip/zulip.git
synced 2025-10-24 00:23:49 +00:00
3bbe5c1110
In addition to documenting the rules.v4 and rules.v6 files slightly, these comments show up in `iptables -L`: ``` root@hostname:~# iptables -L INPUT Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere LOGDROP all -- anywhere localhost/8 ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT tcp -- anywhere anywhere tcp dpt:ssh /* ssh */ ACCEPT tcp -- anywhere anywhere tcp dpt:3000 /* grafana */ ACCEPT tcp -- anywhere anywhere tcp dpt:9100 /* node_exporter */ LOGDROP all -- anywhere anywhere ```
28 lines
741 B
Puppet
28 lines
741 B
Puppet
# @summary Adds an iptables "allow" rule for the host for a port.
|
|
#
|
|
# Rules with the same ordering are ordered by the rule name.
|
|
#
|
|
define zulip_ops::firewall_allow (
|
|
$port = '',
|
|
$proto = 'tcp',
|
|
$order = '50',
|
|
) {
|
|
if $port == '' {
|
|
$portname = $name
|
|
} else {
|
|
$portname = $port
|
|
}
|
|
|
|
concat::fragment { "iptables_v4_${portname}":
|
|
target => '/etc/iptables/rules.v4',
|
|
order => $order,
|
|
content => "-A INPUT -p ${proto} --dport ${portname} -j ACCEPT -m comment --comment \"${name}\"\n",
|
|
}
|
|
|
|
concat::fragment { "iptables_v6_${portname}":
|
|
target => '/etc/iptables/rules.v6',
|
|
order => $order,
|
|
content => "-A INPUT -p ${proto} --dport ${portname} -j ACCEPT -m comment --comment \"${name}\"\n",
|
|
}
|
|
}
|