mirror of
https://git.ecdf.ed.ac.uk/win_automation/windows-ansible.git
synced 2026-10-26 20:57:21 +00:00
63 lines
1.9 KiB
YAML
63 lines
1.9 KiB
YAML
---
|
|
- hosts: localhost
|
|
vars_files:
|
|
- ../vars/common.yml
|
|
|
|
tasks:
|
|
- name: Load variables (Standard vs protected)
|
|
include_vars:
|
|
file: ../vars/{{ project_zone }}.yml
|
|
|
|
- name: Create security groups
|
|
os_security_group:
|
|
cloud: "{{ os_project }}"
|
|
state: "{{ state }}"
|
|
name: "{{ item }}"
|
|
with_items: "{{ security_groups }}"
|
|
|
|
- name: Remove default egress rules (protected only)
|
|
os_security_group:
|
|
cloud: "{{ os_project }}"
|
|
state: "{{ state }}"
|
|
name: "{{ item }}"
|
|
security_group_rules: []
|
|
with_items: "{{ security_groups }}"
|
|
when: project_zone == "protected"
|
|
|
|
- name: Set remote group rules for security groups
|
|
os_security_group_rule:
|
|
cloud: "{{ os_project }}"
|
|
state: "{{ state }}"
|
|
description: "{{ rule.comment }}"
|
|
direction: "{{ rule.direction }}"
|
|
security_group: "{{ rule.group }}"
|
|
remote_group: "{{ rule.remote_group }}"
|
|
protocol: "{{ rule.protocol }}"
|
|
port_range_min: "{{ rule.port_min }}"
|
|
port_range_max: "{{ rule.port_max }}"
|
|
ethertype: IPv4
|
|
loop: "{{ remote_group_rules }}"
|
|
loop_control:
|
|
loop_var: rule
|
|
|
|
- name: Set remote IP rules for security groups
|
|
os_security_group_rule:
|
|
cloud: "{{ os_project }}"
|
|
state: "{{ state }}"
|
|
description: "{{ rule.comment }}"
|
|
direction: "{{ rule.direction }}"
|
|
security_group: "{{ rule.group }}"
|
|
remote_ip_prefix: "{{ rule.remote_ip }}"
|
|
protocol: "{{ rule.protocol }}"
|
|
port_range_min: "{{ rule.port_min }}"
|
|
port_range_max: "{{ rule.port_max }}"
|
|
ethertype: IPv4
|
|
loop: "{{ remote_ip_rules }}"
|
|
loop_control:
|
|
loop_var: rule
|
|
|
|
# 1 task to create groups for default egress
|
|
# 1 task to create rules that are only for ingress
|
|
# maybe use common rules/vars better
|
|
# default egress maybe disabled on clients even on standard (add rules)
|