Nik Afiq
8629a36278
Some checks failed
validate / lint (push) Failing after 2s
UFW allowed 53/udp+tcp from every other internal subnet but not from 10.10.0.0/24 (the WireGuard client subnet), so once the tunnel itself was reachable, decrypted DNS queries still got dropped at minisforum's own INPUT chain before reaching Technitium. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
38 lines
1008 B
YAML
38 lines
1008 B
YAML
---
|
|
# Part of role: common
|
|
# Called by: ansible/playbooks/bootstrap-minisforum.yaml
|
|
# Description: Default variables for the common role including user, packages, firewall ports, and data directories.
|
|
|
|
username: nik
|
|
timezone: Asia/Tokyo
|
|
|
|
base_packages:
|
|
- curl
|
|
- git
|
|
- htop
|
|
- vim
|
|
- wget
|
|
- unzip
|
|
- ca-certificates
|
|
- gnupg
|
|
- lsb-release
|
|
- nfs-common
|
|
|
|
ufw_allowed_ports:
|
|
- { port: 430, proto: tcp, comment: SSH }
|
|
- { port: 80, proto: tcp, comment: HTTP }
|
|
- { port: 443, proto: tcp, comment: HTTPS }
|
|
- { port: 6443, proto: tcp, comment: K3s API server }
|
|
- { port: 10250, proto: tcp, comment: Kubelet, src: 10.10.40.0/24 }
|
|
- { port: 8472, proto: udp, comment: Flannel VXLAN, src: 10.10.40.0/24 }
|
|
- { port: 53, proto: udp, comment: WireGuard road-warrior DNS, src: 10.10.0.0/24 }
|
|
- { port: 53, proto: tcp, comment: WireGuard road-warrior DNS, src: 10.10.0.0/24 }
|
|
|
|
data_dirs:
|
|
- /data/gitea
|
|
- /data/jellyfin
|
|
- /data/pihole
|
|
- /data/dashy
|
|
- /data/glances
|
|
- /data/traefik
|