EOX GitLab Instance

Skip to content
Snippets Groups Projects
Commit 50ad9826 authored by Karl Grube's avatar Karl Grube
Browse files

added ip rule script to make things cleaner

parent 8150411b
No related branches found
No related tags found
No related merge requests found
...@@ -15,6 +15,12 @@ ...@@ -15,6 +15,12 @@
- name: set my interfaces - name: set my interfaces
import_role: import_role:
name: my_interfaces name: my_interfaces
vars:
service_name: prometheus
ip_service_rules:
- '{% if loopback_ipv6_address is defined %}from {{loopback_ipv6_address}} lookup service priority 255{% endif %}'
- dport 9100 lookup service priority 900
- from all sport 9100 lookup service priority 899
when: my_interfaces is defined when: my_interfaces is defined
tags: my_interfaces tags: my_interfaces
......
...@@ -13,10 +13,8 @@ SendSIGKILL=no ...@@ -13,10 +13,8 @@ SendSIGKILL=no
# IP rule adjustments for Prometheus # IP rule adjustments for Prometheus
{% if use_service_vrf == True %} {% if use_service_vrf == True %}
ExecStartPre=+/usr/sbin/ip -6 rule add dport 9100 lookup service priority 900 ExecStartPre=+/usr/local/bin/prometheus_ip_rule up
ExecStartPre=+/usr/sbin/ip -6 rule add from all sport 9100 lookup service priority 899 ExecStop=+/usr/local/bin/prometheus_ip_rule down
ExecStop=+/usr/sbin/ip -6 rule del from all sport 9100 lookup service priority 899
ExecStop=+/usr/sbin/ip -6 rule del dport 9100 lookup service priority 900
{% endif %} {% endif %}
# systemd hardening-options # systemd hardening-options
...@@ -43,4 +41,4 @@ RestrictRealtime=true ...@@ -43,4 +41,4 @@ RestrictRealtime=true
SystemCallArchitectures=native SystemCallArchitectures=native
[Install] [Install]
WantedBy=multi-user.target WantedBy=multi-user.target
\ No newline at end of file
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment