roles

omero/roles/iptables_raw/.github/workflows/molecule.yml

@@ -0,0 +1,59 @@
+---
+name: Molecule
+# yamllint disable-line rule:truthy
+on:
+  push:
+  pull_request:
+  schedule:
+    - cron: '29 21 * * 0'
+
+jobs:
+
+  list-scenarios:
+    runs-on: ubuntu-22.04
+    outputs:
+      matrix: ${{ steps.listscenarios.outputs.scenarios }}
+    steps:
+      - uses: actions/checkout@v4
+      - id: listscenarios
+        uses: ome/action-ansible-molecule-list-scenarios@main
+
+  test:
+    name: Test
+    needs:
+      - list-scenarios
+    runs-on: ubuntu-22.04
+    strategy:
+      # Keep running so we can see if other tests pass
+      fail-fast: false
+      matrix:
+        scenario: ${{fromJson(needs.list-scenarios.outputs.matrix)}}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v4
+        with:
+          python-version: '3.8'
+      - name: Install Ansible & Molecule
+        run: |
+            pip install "ansible<8" "ansible-lint<6.13" flake8
+            pip install "molecule<5" "ansible-compat<4"
+            pip install molecule-plugins[docker] pytest-testinfra
+      - name: Run molecule
+        run: molecule test -s "${{ matrix.scenario }}"
+
+  publish:
+    name: Galaxy
+    if: startsWith(github.ref, 'refs/tags')
+    needs:
+      - test
+    runs-on: ubuntu-20.04
+    steps:
+      - name: galaxy
+        uses: robertdebock/[email protected]
+        with:
+          galaxy_api_key: ${{ secrets.GALAXY_API_KEY }}
+          git_branch: ${{  github.ref_name }}
+
+
+# notifications:
+#   webhooks: https://galaxy.ansible.com/api/v1/notifications/

omero/roles/iptables_raw/LICENSE.md

@@ -0,0 +1,22 @@
+Copyright (c) 2019, University of Dundee
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

omero/roles/iptables_raw/README.md

@@ -0,0 +1,68 @@
+Iptables Raw
+============
+
+[![Actions Status](https://github.com/ome/ansible-role-iptables-raw/workflows/Molecule/badge.svg)](https://github.com/ome/ansible-role-iptables-raw/actions)
+[![Ansible Role](https://img.shields.io/badge/ansible--galaxy-iptables_raw-blue.svg)](https://galaxy.ansible.com/ui/standalone/roles/ome/iptables_raw/)
+
+Import the Iptables Raw library and make it available as a task.
+Ensure iptables is active.
+
+See these links for full documentation on the `iptables_raw` module:
+- https://nordeus.com/blog/engineering/managing-iptables-with-ansible-the-easy-way/
+- https://github.com/Nordeus/ansible_iptables_raw
+- https://github.com/ansible/ansible/pull/21054
+
+
+Parameters
+----------
+
+Optional:
+- `iptables_raw_disable_firewalld`: Disable the firewalld service (if installed and enabled it will conflict), default `True`
+
+
+Development
+-----------
+The [`library/iptables_raw.py`](library/iptables_raw.py) version is https://github.com/Nordeus/ansible_iptables_raw/tree/34672590224f393016ad086f82054319108e67ad (2018-02-18) with the following change to prevent ansible-lint/flake8 failing:
+
+```diff
+diff --git a/library/iptables_raw.py b/library/iptables_raw.py
+index 71dfc0d..978a6c7 100644
+--- a/library/iptables_raw.py
++++ b/library/iptables_raw.py
+@@ -344,7 +344,7 @@ class Iptables:
+     def _is_debian(self):
+         return os.path.isfile('/etc/debian_version')
+
+-    # If /etc/arch-release exist, this means this is an ArchLinux OS
++    # If /etc/arch-release exist, this means this is an ArchLinux OS
+     def _is_arch_linux(self):
+         return os.path.isfile('/etc/arch-release')
+
+```
+
+
+Example Playbook
+----------------
+
+    - hosts: localhost
+      roles:
+        - role: ome.iptables-raw
+
+      tasks:
+        # Block all incoming connections apart from ssh
+        - ome.iptables_raw:
+            name: test_rules
+            keep_unmanaged: no
+            rules: |
+              -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
+              -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
+              -A INPUT -j REJECT
+              -A FORWARD -j REJECT
+              -A OUTPUT -j ACCEPT
+            state: present
+
+
+Author Information
+------------------
+
+[email protected]