You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
<description>Init role This is meant to ALWAYS be included as the first task of a play. If you include this role, as you will in the vast majority of cases, be sure to also include the _exit role as the last task of the play.
Default variables --- # Set this variable to true to tell ce-provision it is running in a container. is_local: false _ce_provision_username: &#34;{% if is_local %}ce-dev{% else %}controller{% endif %}&#34; _venv_path: &#34;/home/{{ _ce_provision_username }}/ce-python&#34; _venv_command: /usr/bin/python3 -m venv _venv_install_username: &#34;{{ _ce_provision_username }}&#34; _ce_ansible_timer_name: upgrade_ansible # AWS variables - if you are using an AWS account, you can preset certain variables # Generally it is recommended to place these in your ce-provision-config repository under hosts/group_vars/all #_aws_profile: example # boto profile name #_aws_region: eu-west-1 _init: # A list of var directories to include.</description>
43
+
<description>Init role This is meant to ALWAYS be included as the first task of a play. If you include this role, as you will in the vast majority of cases, be sure to also include the _exit role as the last task of the play.
Default variables --- # Set this variable to true to tell ce-provision it is running in a container. is_local: false _ce_provision_username: &#34;{% if is_local %}ce-dev{% else %}controller{% endif %}&#34; _venv_path: &#34;/home/{{ _ce_provision_username }}/ce-python&#34; _venv_command: /usr/bin/python3 -m venv _venv_install_username: &#34;{{ _ce_provision_username }}&#34; _ce_ansible_timer_name: upgrade_ansible # AWS variables - if you are using an AWS account, you can preset certain variables # Generally it is recommended to place these in your ce-provision-config repository under hosts/group_vars/all #_aws_profile: example # boto profile name #_aws_region: eu-west-1 # AWS tags _aws_resource_name: &#34;&#34; # Name # _profile: web_server # Profile # _env_type: dev # Env # _infra_name: acme # Infra _init: # A list of var directories to include.</description>
</span></span><spanstyle="display:flex;"><span><spanstyle="color:#75715e"># A list of var directories to include. We only support .yml extensions.</span>
33
39
</span></span><spanstyle="display:flex;"><span><spanstyle="color:#75715e"># This is used to detect if the playbook must re-run or not.</span>
</span></span><spanstyle="display:flex;"><span> - <spanstyle="color:#ae81ff">common_network</span><spanstyle="color:#75715e"># rule always needs to be last so the DROP rules in the OUTPUT chain get applied at the end</span>
</span></span><spanstyle="display:flex;"><span><spanstyle="color:#75715e"># Standard ports for Prometheus outbound rules to allow scraping of exporters</span>
</span></span><spanstyle="display:flex;"><span> - <spanstyle="color:#e6db74">"iptables -A INPUT -p icmp --icmp-type 8 -s 0/0 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT"</span><spanstyle="color:#75715e"># ICMP ping in</span>
107
+
</span></span><spanstyle="display:flex;"><span> - <spanstyle="color:#e6db74">"iptables -A INPUT -p icmp --icmp-type 128 -s 0/0 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT"</span><spanstyle="color:#75715e"># ICMP ping in</span>
108
+
</span></span><spanstyle="display:flex;"><span> - <spanstyle="color:#e6db74">"iptables -A OUTPUT -p icmp --icmp-type 0 -d 0/0 -m state --state ESTABLISHED,RELATED -j ACCEPT"</span><spanstyle="color:#75715e"># ICMP ping out</span>
109
+
</span></span><spanstyle="display:flex;"><span> - <spanstyle="color:#e6db74">"iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT"</span><spanstyle="color:#75715e"># established connections out</span>
110
+
</span></span><spanstyle="display:flex;"><span> - <spanstyle="color:#e6db74">"iptables -A OUTPUT -o lo -j ACCEPT"</span><spanstyle="color:#75715e"># allow all local traffic</span>
111
+
</span></span><spanstyle="display:flex;"><span> - <spanstyle="color:#e6db74">"iptables -A OUTPUT -p tcp --dport 1025:65535 -j DROP"</span><spanstyle="color:#75715e"># block high port tcp traffic outbound</span>
112
+
</span></span><spanstyle="display:flex;"><span> - <spanstyle="color:#e6db74">"iptables -A OUTPUT -p udp --dport 1025:65535 -j DROP"</span><spanstyle="color:#75715e"># block high port udp traffic outbound</span>
<description>Init role This is meant to ALWAYS be included as the first task of a play. If you include this role, as you will in the vast majority of cases, be sure to also include the _exit role as the last task of the play.
Default variables --- # Set this variable to true to tell ce-provision it is running in a container. is_local: false _ce_provision_username: &#34;{% if is_local %}ce-dev{% else %}controller{% endif %}&#34; _venv_path: &#34;/home/{{ _ce_provision_username }}/ce-python&#34; _venv_command: /usr/bin/python3 -m venv _venv_install_username: &#34;{{ _ce_provision_username }}&#34; _ce_ansible_timer_name: upgrade_ansible # AWS variables - if you are using an AWS account, you can preset certain variables # Generally it is recommended to place these in your ce-provision-config repository under hosts/group_vars/all #_aws_profile: example # boto profile name #_aws_region: eu-west-1 _init: # A list of var directories to include.</description>
15
+
<description>Init role This is meant to ALWAYS be included as the first task of a play. If you include this role, as you will in the vast majority of cases, be sure to also include the _exit role as the last task of the play.
Default variables --- # Set this variable to true to tell ce-provision it is running in a container. is_local: false _ce_provision_username: &#34;{% if is_local %}ce-dev{% else %}controller{% endif %}&#34; _venv_path: &#34;/home/{{ _ce_provision_username }}/ce-python&#34; _venv_command: /usr/bin/python3 -m venv _venv_install_username: &#34;{{ _ce_provision_username }}&#34; _ce_ansible_timer_name: upgrade_ansible # AWS variables - if you are using an AWS account, you can preset certain variables # Generally it is recommended to place these in your ce-provision-config repository under hosts/group_vars/all #_aws_profile: example # boto profile name #_aws_region: eu-west-1 # AWS tags _aws_resource_name: &#34;&#34; # Name # _profile: web_server # Profile # _env_type: dev # Env # _infra_name: acme # Infra _init: # A list of var directories to include.</description>
0 commit comments