From e7e193db63d464a6d7f764b6e0aa50980b49e5f1 Mon Sep 17 00:00:00 2001 From: abrown38 Date: Fri, 31 May 2024 08:33:33 +0100 Subject: [PATCH] proxy VM changes --- ansible/playbooks/openstack-vms.yml | 25 ++++++++++++++++++++++++- ansible/vars/common.yml | 1 + ansible/vars/protected.yml | 9 +++++---- 3 files changed, 30 insertions(+), 5 deletions(-) diff --git a/ansible/playbooks/openstack-vms.yml b/ansible/playbooks/openstack-vms.yml index 998b094..d3ce689 100644 --- a/ansible/playbooks/openstack-vms.yml +++ b/ansible/playbooks/openstack-vms.yml @@ -320,4 +320,27 @@ register: common_status2 until: 'common_status2.servers|length == 6' retries: 100 - delay: 60 \ No newline at end of file + delay: 60 + + - name: Create proxy + tags: teardown + os_server: + name: "{{ os_project }}-proxy" + state: "{{ state }}" + image: "{{ proxy_image }}" + flavor: 3661211f-673a-4777-8857-fd243d6c407d + timeout: 900 + boot_from_volume: true + volume_size: 40 + terminate_volume: yes + key_name: proxy + security_groups: + - proxy + network: "{{ os_network }}" + metadata: + name: "proxy" + win_project: "{{ win_project }}" + type: server + variant: web_proxy + os: linux + when: project_zone == 'protected' \ No newline at end of file diff --git a/ansible/vars/common.yml b/ansible/vars/common.yml index ea15b8a..acaf785 100644 --- a/ansible/vars/common.yml +++ b/ansible/vars/common.yml @@ -10,6 +10,7 @@ vm_initial_password: %VM_INITIAL_PASSWORD% ########## Do Not Edit ########## vm_image: 3f193ea7-321d-418b-a233-da64661b08b1 +proxy_image: 62669efd-ee43-4148-848c-b82f49ca2f45 server_vm_flavor: 3661211f-673a-4777-8857-fd243d6c407d user_vm_flavor: 3661211f-673a-4777-8857-fd243d6c407d gpu_flavor: 3661211f-673a-4777-8857-fd243d6c407d # CHANGE THIS diff --git a/ansible/vars/protected.yml b/ansible/vars/protected.yml index 8e7a080..9fb67f1 100644 --- a/ansible/vars/protected.yml +++ b/ansible/vars/protected.yml @@ -55,6 +55,8 @@ remote_group_rules: - { direction: "egress", protocol: "tcp", port_min: 443, port_max: 443, group: "domain_member", remote_group: "chocolatey_server", comment: "Chocolatey HTTPS"} - { direction: "egress", protocol: "tcp", port_min: 3128, port_max: 3128, group: "user_vms", remote_group: "proxy", comment: "HTTP proxy"} + - { direction: "ingress", protocol: "tcp", port_min: 3128, port_max: 3128, group: "proxy", remote_group: "user_vms", comment: "HTTP proxy"} + remote_ip_rules: # User VMs @@ -69,10 +71,9 @@ remote_ip_rules: - { direction: "egress", protocol: "udp", port_min: 67, port_max: 67, group: "domain_member", remote_ip: "0.0.0.0/0", comment: "DHCP"} - { direction: "egress", protocol: "tcp", port_min: 1688, port_max: 1688, group: "domain_member", remote_ip: "172.16.26.19/32", comment: "Windows Activation"} # Proxy - - { direction: "ingress", protocol: "tcp", port_min: 3128, port_max: 3128, group: "proxy", remote_group: "user_vms", comment: "HTTP proxy"} - - { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_group: "10.24.4.71/32", comment: "SSH rundeck 1"} - - { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_group: "10.24.3.172/32", comment: "SSH rundeck 2"} - - { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_group: "10.24.3.242/32", comment: "SSH rundeck 3"} + - { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_ip: "10.24.4.71/32", comment: "SSH rundeck 1"} + - { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_ip: "10.24.3.172/32", comment: "SSH rundeck 2"} + - { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_ip: "10.24.3.242/32", comment: "SSH rundeck 3"} # ONLY PROTECTED FOR PROXY SSH and http[s]