mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 12:03:59 +00:00
792329ddd2
- k3s role: persist svc.prole.org reachability with a systemd oneshot that inserts ACCEPT rules ahead of Tailscale filter rules (configurable ports/chain). - init_monitoring: enable Grafana datasource sidecar and provision a stable Prometheus datasource (uid 'prometheus') so CloudNativePG dashboards bind correctly. - tests: assert datasource sidecar config and datasource ConfigMap is applied. Co-authored-by: Junie <junie@jetbrains.com>
43 lines
1.3 KiB
YAML
43 lines
1.3 KiB
YAML
---
|
|
|
|
- name: Install prole svc firewall enforcement script
|
|
ansible.builtin.template:
|
|
src: prole-svc-iptables-allow.sh.j2
|
|
dest: /usr/local/sbin/prole-svc-iptables-allow
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
when:
|
|
- k3s_firewall_svc_allow_enabled | default(true) | bool
|
|
- ansible_service_mgr | default('') == 'systemd'
|
|
|
|
- name: Install prole svc firewall systemd unit
|
|
ansible.builtin.template:
|
|
src: prole-svc-iptables-allow.service.j2
|
|
dest: /etc/systemd/system/prole-svc-iptables-allow.service
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
register: _prole_svc_fw_unit
|
|
when:
|
|
- k3s_firewall_svc_allow_enabled | default(true) | bool
|
|
- ansible_service_mgr | default('') == 'systemd'
|
|
|
|
- name: Reload systemd daemon (svc firewall unit)
|
|
ansible.builtin.systemd:
|
|
daemon_reload: true
|
|
when:
|
|
- k3s_firewall_svc_allow_enabled | default(true) | bool
|
|
- ansible_service_mgr | default('') == 'systemd'
|
|
- _prole_svc_fw_unit is defined
|
|
- _prole_svc_fw_unit.changed
|
|
|
|
- name: Enable and run prole svc firewall unit
|
|
ansible.builtin.systemd:
|
|
name: prole-svc-iptables-allow.service
|
|
enabled: true
|
|
state: restarted
|
|
when:
|
|
- k3s_firewall_svc_allow_enabled | default(true) | bool
|
|
- ansible_service_mgr | default('') == 'systemd'
|