aim-web2.1.0rc9

2026-09-22 19:23:17 +02:00
parent d095887d2e
commit 3dfc80b782
438 changed files with 31613 additions and 1510 deletions
@@ -0,0 +1,153 @@
+---
+# Policy-preserving extraction from configure_pfsense_initial.yml. Do not change rule values without separate approval.
+- name: Check current bell state
+  ansible.builtin.raw: sysctl -n hw.syscons.bell
+  register: bell_state
+  changed_when: false
+- name: Disable startup/shutdown beep
+  ansible.builtin.raw: sysctl hw.syscons.bell=0
+  when: bell_state.stdout.strip() == "1"
+  changed_when: true
+- name: Create alias bf_wan_extern
+  pfsensible.core.pfsense_alias:
+    name: bf_wan_extern
+    descr: bitformer WAN IP Adressen
+    address: 217.13.70.132 87.138.207.238 80.152.155.27 217.13.174.202
+    type: host
+    state: present
+- name: Create alias bf_wartung
+  pfsensible.core.pfsense_alias:
+    name: bf_wartung
+    descr: bitformer Wartungs-IP
+    address: 10.240.0.1
+    type: host
+    state: present
+- name: Create alias rfc_1918_5735
+  pfsensible.core.pfsense_alias:
+    name: rfc_1918_5735
+    descr: RFC1918, RFC5735 (private IPs)
+    address: 10.0.0.0/8 169.254.0.0/16 172.16.0.0/12 192.168.0.0/16
+    type: network
+    state: present
+- name: 'Add NAT outbound traffic rule (Port: 500)'
+  pfsensible.core.pfsense_nat_outbound:
+    descr: 'Outbound NAT for private IP space (Port: 500)'
+    interface: wan
+    address: null
+    source: rfc_1918_5735
+    destination: any:500
+    staticnatport: true
+    state: present
+- name: Add NAT outbound traffic rule
+  pfsensible.core.pfsense_nat_outbound:
+    descr: Outbound NAT for private IP space
+    interface: wan
+    address: null
+    source: rfc_1918_5735
+    destination: any
+    state: present
+- name: 'Add firewall rule: Allow Ping'
+  pfsensible.core.pfsense_rule:
+    name: Allow Ping
+    action: pass
+    interface: wan
+    ipprotocol: inet
+    protocol: icmp
+    icmptype: echoreq
+    source: any
+    destination: IP:wan
+    log: true
+    state: present
+- name: 'Add firewall rule: Allow Webinterface access'
+  pfsensible.core.pfsense_rule:
+    name: bitformer Webinterface access rule
+    action: pass
+    interface: wan
+    ipprotocol: inet
+    protocol: tcp
+    destination_port: 443
+    source: bf_wan_extern
+    destination: IP:wan
+    log: true
+    state: present
+- name: Create Anti-Lockout ports alias
+  pfsensible.core.pfsense_alias:
+    name: anti_lockout_ports
+    type: port
+    address: 22 80 443
+    descr: Ports for Anti-Lockout access
+- name: Add custom Anti-Lockout Rule
+  pfsensible.core.pfsense_rule:
+    name: Custom Anti-Lockout Rule
+    action: pass
+    interface: wan
+    ipprotocol: inet
+    protocol: tcp
+    destination_port: anti_lockout_ports
+    source: any
+    destination: IP:wan
+    log: true
+    state: present
+- name: Add bitconnect VPN CA 2021
+  pfsensible.core.pfsense_ca:
+    name: bitconnect VPN CA 2021
+    certificate: |
+      -----BEGIN CERTIFICATE-----
+      MIIFbDCCA1SgAwIBAgIUWV573JfAztSareWb4jnkNIdlEt8wDQYJKoZIhvcNAQEL
+      BQAwITEfMB0GA1UEAwwWYml0Y29ubmVjdCBWUE4gQ0EgMjAyMTAeFw0yMTEwMDgx
+      NjA1MzNaFw0zMTEwMDYxNjA1MzNaMCExHzAdBgNVBAMMFmJpdGNvbm5lY3QgVlBO
+      IENBIDIwMjEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDjjoWk81zG
+      vmdKCICW27cnQV6kmDwwXezC7cdmk8nVKnlcJAnVPExYV1M1wa9OYDgjb+Jc7vEV
+      UKKc7h/JtWt5OSg7aLq5eh6ZZminYG+lrKC7CFhyPnKuLPW4D6ye6iTVpwlhMMbv
+      fCiinuA2shniQtX21QYc8jxKdJnmfgv7/JJ0BxnWCyE8yn1xy6DyjPH9ystzKFGO
+      C3HH2wH2+sgKuiyk+8yxEF3hktMIDZ/D1gTyw8wsL4PgOs78EBSf0UKjAaBBjem8
+      rICxBo4yh7YvVJ+MMLc+2IMcyM3wpYPbMpA/0hXoWsAeYEOvrZR+MYQ08cQw8QEk
+      MHetIjbksd9D1OSdMfghr+A+dxVpQWTOnUnG48L84E/6RD0STyz/uJjNDJ5Qn4uV
+      8e6ELHbbPiWVQWw+kg8tVetH6+WELXf/7pUnV9uYr7DvijEROP6l1IX/r92qC270
+      /QFiadYX0lroqaWdwk5z7DFnVVcCHqchygS97exzDg68LkSJ5pOZ6spIr9WfaGxD
+      3dva4ekC/HEZUdau+NnBPnOCLD6EqOnh3RAJosgX6/eb5LHhk5agruM+1PZcWPiL
+      5D0HvNjKOCGXW2yVd1fAdOy0onP4OQHK3gJPNFJ9m/LXnn5+CHvYct+3qDlxZcCR
+      qH9QBE7kC/8pRmHZqC1g0rn8yiQ012eCpwIDAQABo4GbMIGYMB0GA1UdDgQWBBQ4
+      pYw9Df2Ln2pUE/xRDjhebugWpTBcBgNVHSMEVTBTgBQ4pYw9Df2Ln2pUE/xRDjhe
+      bugWpaElpCMwITEfMB0GA1UEAwwWYml0Y29ubmVjdCBWUE4gQ0EgMjAyMYIUWV57
+      3JfAztSareWb4jnkNIdlEt8wDAYDVR0TBAUwAwEB/zALBgNVHQ8EBAMCAQYwDQYJ
+      KoZIhvcNAQELBQADggIBAN1OOdv5rDgtBhYnmnId4iifvjzKQEQF5go4cJDueUo4
+      86u6xJrv83sC53FKxaAcNZUxJEcFFBHKlCUTNADsKDdQxIPA2Ow6goIx914VbFO/
+      OmkFWS+53o4V8zRrwTxJi3Ps0R3sgp3pok5fQNL30tMZIf1Ug05jOqSCT8GBzIS8
+      wwSw6aNi/Zcs9sBuaEEap47faTowk53EJykUd8htzH/3E5ioi3hE8TsZYPKb4Frk
+      mMqRbX6N78fZ0xOIewh58S4eeGlRCGlRs45ciVxuryTaloFfDDBFFBR3V4q4Y/y9
+      dvjiRmDs4fod1ZGEFUfVyDPXjzWCUUQiMHxUoh9s06i5zO3YCB/mkh+11ohyE109
+      ciN495vhpTONQ8GzXLc87GjVUow7btn3lfaMf1sTfLhAueHNNbDHTnhRFkUtrdCx
+      73+MYpiSlLpBxnyLkTM4umYXeYNN5Od0UjYZZqlLK9MNZrM5CwVxjRxJjgV6Nbap
+      4Apnfqi+d3Ulnc6Zk8w0tiVcRfrLR6EVA3JEHqFQLuXbU1+K8C0N9YNFHy2iGAxF
+      Ysx7aJVvmzyoiB06/qQrHcjeizVJaqR7w6+1cuTKo+fdvp2KtyK8+pFtQt4n+unw
+      3eLC1NdcEyWBtlKqG6sjSXCBCgc1z2wAOfR+sQsH64uVHqxND4rPo8X4uo28Jgv9
+      -----END CERTIFICATE-----
+    state: present
+- name: Add bitconnect VPN-Client
+  pfsensible.core.pfsense_openvpn_client:
+    name: bitformer Wartungs-VPN
+    ca: bitconnect VPN CA 2021
+    cert: bf-customers-vpn01
+    create_gw: both
+    data_ciphers:
+      - AES-256-GCM
+      - AES-256-CBC
+      - AES-128-GCM
+      - CHACHA20-POLY1305
+    data_ciphers_fallback: AES-256-CBC
+    dev_mode: tun
+    digest: SHA384
+    interface: any
+    mode: p2p_tls
+    protocol: UDP4
+    server_addr: vpngw01.bitformer.net
+    server_port: 42030
+    state: present
+- name: Print left over manual settings to configure
+  ansible.builtin.debug:
+    msg:
+      - 'Manuelle Einstellungen müssen vorgenommen werden:'
+      - 'Firewall Max Table Entries: 500000'
+      - Disable startup/shutdown beep
+      - Password protect the console