diff options
8 files changed, 102 insertions, 0 deletions
diff --git a/ansible/roles/firewall/.yamllint b/ansible/roles/firewall/.yamllint new file mode 100644 index 00000000..ad0be760 --- /dev/null +++ b/ansible/roles/firewall/.yamllint @@ -0,0 +1,11 @@ +extends: default + +rules: + braces: + max-spaces-inside: 1 + level: error + brackets: + max-spaces-inside: 1 + level: error + line-length: disable + truthy: disable diff --git a/ansible/roles/firewall/molecule/default/Dockerfile.j2 b/ansible/roles/firewall/molecule/default/Dockerfile.j2 new file mode 100644 index 00000000..e6aa95d3 --- /dev/null +++ b/ansible/roles/firewall/molecule/default/Dockerfile.j2 @@ -0,0 +1,14 @@ +# Molecule managed + +{% if item.registry is defined %} +FROM {{ item.registry.url }}/{{ item.image }} +{% else %} +FROM {{ item.image }} +{% endif %} + +RUN if [ $(command -v apt-get) ]; then apt-get update && apt-get install -y python sudo bash ca-certificates && apt-get clean; \ + elif [ $(command -v dnf) ]; then dnf makecache && dnf --assumeyes install python sudo python-devel python*-dnf bash && dnf clean all; \ + elif [ $(command -v yum) ]; then yum makecache fast && yum install -y python sudo yum-plugin-ovl bash && sed -i 's/plugins=0/plugins=1/g' /etc/yum.conf && yum clean all; \ + elif [ $(command -v zypper) ]; then zypper refresh && zypper install -y python sudo bash python-xml && zypper clean -a; \ + elif [ $(command -v apk) ]; then apk update && apk add --no-cache python sudo bash ca-certificates; \ + elif [ $(command -v xbps-install) ]; then xbps-install -Syu && xbps-install -y python sudo bash ca-certificates && xbps-remove -O; fi diff --git a/ansible/roles/firewall/molecule/default/molecule.yml b/ansible/roles/firewall/molecule/default/molecule.yml new file mode 100644 index 00000000..81ace9ce --- /dev/null +++ b/ansible/roles/firewall/molecule/default/molecule.yml @@ -0,0 +1,33 @@ +--- +dependency: + name: galaxy +driver: + name: docker +lint: + name: yamllint +platforms: + - name: centos7 + image: couchbase/centos7-systemd + privileged: true + command: "" + volumes: + - /sys/fs/cgroup:/sys/fs/cgroup:ro + + - name: ubuntu18 + image: solita/ubuntu-systemd:18.04 + command: /sbin/init + privileged: true + volumes: + - /lib/modules:/lib/modules:ro +provisioner: + name: ansible + env: + ANSIBLE_ROLES_PATH: ../../../../test/roles + lint: + name: ansible-lint +verifier: + name: testinfra + options: + verbose: true + lint: + name: flake8 diff --git a/ansible/roles/firewall/molecule/default/playbook.yml b/ansible/roles/firewall/molecule/default/playbook.yml new file mode 100644 index 00000000..73b20eac --- /dev/null +++ b/ansible/roles/firewall/molecule/default/playbook.yml @@ -0,0 +1,5 @@ +--- +- name: Converge + hosts: all + roles: + - role: firewall diff --git a/ansible/roles/firewall/molecule/default/prepare.yml b/ansible/roles/firewall/molecule/default/prepare.yml new file mode 100644 index 00000000..5e0e9a33 --- /dev/null +++ b/ansible/roles/firewall/molecule/default/prepare.yml @@ -0,0 +1,5 @@ +--- +- name: Prepare + hosts: all + roles: + - prepare-firewall diff --git a/ansible/roles/firewall/molecule/default/tests/test_default.py b/ansible/roles/firewall/molecule/default/tests/test_default.py new file mode 100644 index 00000000..a346cb57 --- /dev/null +++ b/ansible/roles/firewall/molecule/default/tests/test_default.py @@ -0,0 +1,18 @@ +import os + +import testinfra.utils.ansible_runner + +testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner( + os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all') + + +def test_firewall_service_disabled(host): + distribution = host.system_info.distribution + if distribution == "centos": + svc = "firewalld" + elif distribution == "ubuntu": + svc = "ufw" + service = host.service(svc) + + assert not service.is_running + assert not service.is_enabled diff --git a/ansible/test/roles/prepare-firewall/defaults/main.yml b/ansible/test/roles/prepare-firewall/defaults/main.yml new file mode 100644 index 00000000..b450099a --- /dev/null +++ b/ansible/test/roles/prepare-firewall/defaults/main.yml @@ -0,0 +1,5 @@ +--- +firewall: + package_name: + RedHat: 'firewalld' + Debian: 'ufw' diff --git a/ansible/test/roles/prepare-firewall/tasks/main.yml b/ansible/test/roles/prepare-firewall/tasks/main.yml new file mode 100644 index 00000000..a997d14f --- /dev/null +++ b/ansible/test/roles/prepare-firewall/tasks/main.yml @@ -0,0 +1,11 @@ +--- +- name: Install firewall + package: + name: "{{ firewall.package_name[ansible_facts.os_family] }}" + state: present + +- name: Start and enable firewall + service: + name: "{{ firewall.package_name[ansible_facts.os_family] }}" + state: started + enabled: true |