Nik Afiq
939a7c6ed1
Some checks failed
validate / lint (push) Failing after 1s
Adds explicit UFW routed-allow rules (10.42.0.0/16 pod-to-pod, pod-to-Technitium DNS) since these nodes default their routed/FORWARD policy to DROP. Also brings nik-debian's NFS (2049) and SMB (445) ports under Ansible-managed UFW rules via the existing nfs-server role, scoped to the Lab/Trusted networks that need them. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
59 lines
1.3 KiB
YAML
59 lines
1.3 KiB
YAML
---
|
|
# Part of role: nfs-server
|
|
# Called by: ansible/playbooks/setup-nfs-debian.yaml
|
|
# Description: Installs NFS server, configures exports, allows NFS/SMB through UFW, and ensures the backup directory exists.
|
|
|
|
- name: Install NFS server
|
|
ansible.builtin.apt:
|
|
name:
|
|
- nfs-kernel-server
|
|
- nfs-common
|
|
state: present
|
|
update_cache: true
|
|
become: true
|
|
|
|
- name: Configure NFS exports
|
|
ansible.builtin.template:
|
|
src: exports.j2
|
|
dest: /etc/exports
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
become: true
|
|
notify: Restart NFS server
|
|
|
|
- name: Ensure NFS server is running
|
|
ansible.builtin.service:
|
|
name: nfs-kernel-server
|
|
state: started
|
|
enabled: true
|
|
become: true
|
|
|
|
- name: Allow NFS access through UFW from the k3s server
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "2049"
|
|
proto: tcp
|
|
src: "{{ nfs_allowed_ip }}"
|
|
comment: NFS from k3s server
|
|
become: true
|
|
|
|
- name: Allow SMB access through UFW from trusted networks
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "445"
|
|
proto: tcp
|
|
src: "{{ item }}"
|
|
comment: SMB (Samba)
|
|
loop: "{{ smb_allowed_subnets }}"
|
|
become: true
|
|
|
|
- name: Ensure backup directory exists with correct ownership
|
|
ansible.builtin.file:
|
|
path: /home/nik/backups/gitea
|
|
state: directory
|
|
owner: "1001"
|
|
group: "1001"
|
|
mode: "0755"
|
|
become: true
|