Using configuration management systems - Revision history

Arturo: /* puppet */ add community module

2020-12-16T10:30:51Z

puppet: add community module

← Older revision		Revision as of 10:30, 16 December 2020
Line 10:		Line 10:
	'''NOTE:''' if you copy-paste this example make sure you adapt it to your environment. This code below is an example and hasn't been tested at all.		'''NOTE:''' if you copy-paste this example make sure you adapt it to your environment. This code below is an example and hasn't been tested at all.

	== a base puppet module ==		== community module ==

			The community already developed deep integration between puppet and nftables and other related firewalling mechanisms (like firewalld).

			* https://forge.puppet.com/tags/nftables
			* https://github.com/voxpupuli/puppet-nftables

			== raw example ==

			This a simplified raw example.

			=== a base puppet module ===

	A file like named this: '''modules/nftables/manifest/init.pp'''		A file like named this: '''modules/nftables/manifest/init.pp'''
Line 60:		Line 71:
	</source>		</source>

	== a module to introduce nftables config ==		=== a module to introduce nftables config ===

	This module is responsible for injecting into the system the new nftables config.		This module is responsible for injecting into the system the new nftables config.
Line 79:		Line 90:
	</source>		</source>

	== other modules adding nftables configuration ==		=== other modules adding nftables configuration ===

	In this example, we have an apache module that creates some additional rules and configuration for nftables.		In this example, we have an apache module that creates some additional rules and configuration for nftables.

Arturo: introduce ansible section

2019-07-30T15:41:33Z

introduce ansible section

← Older revision		Revision as of 15:41, 30 July 2019
Line 97:		Line 97:
	}		}
	</source>		</source>

			= ansible =

			Check some examples on how people are using nftables with ansible:

			* https://github.com/ipr-cnrs/nftables
			* https://github.com/Frzk/ansible-role-nftables

Arturo: create puppet section

2019-07-30T15:40:23Z

create puppet section

← Older revision		Revision as of 15:40, 30 July 2019
Line 3:		Line 3:
	The basic approach is to have a central point where we deploy nftables, with a ruleset layout that allows other files to be deployed and loaded atomically by nftables.		The basic approach is to have a central point where we deploy nftables, with a ruleset layout that allows other files to be deployed and loaded atomically by nftables.
	Other components (modules, or profiles, or whatever) then deploy specific rules or other configuration as required.		Other components (modules, or profiles, or whatever) then deploy specific rules or other configuration as required.

			= puppet =

	For the sake of the example this page uses puppet as reference, but the same concepts and mechanism could be applied to others.		For the sake of the example this page uses puppet as reference, but the same concepts and mechanism could be applied to others.

Arturo: /* other modules adding nftables configuration */ fix typo in file name

2019-07-30T15:35:54Z

other modules adding nftables configuration: fix typo in file name

← Older revision		Revision as of 15:35, 30 July 2019
Line 80:		Line 80:

	In this example, we have an apache module that creates some additional rules and configuration for nftables.		In this example, we have an apache module that creates some additional rules and configuration for nftables.
	This is a file named like this: '''modules/~~nftables~~/manifest/~~rule~~.pp'''
			This is a file named like this: '''modules/apache/manifest/config.pp'''

	<source lang="puppet">		<source lang="puppet">

Arturo: create page

2019-07-30T15:34:57Z

create page

New page

This page shows a basic example on how to integrate nftables [[Scripting | scripting]] capabilities with configuration management systems (like puppet, ansible, chef, salt and others).

The basic approach is to have a central point where we deploy nftables, with a ruleset layout that allows other files to be deployed and loaded atomically by nftables.
Other components (modules, or profiles, or whatever) then deploy specific rules or other configuration as required.

For the sake of the example this page uses puppet as reference, but the same concepts and mechanism could be applied to others.

'''NOTE:''' if you copy-paste this example make sure you adapt it to your environment. This code below is an example and hasn't been tested at all.

== a base puppet module ==

A file like named this: '''modules/nftables/manifest/init.pp'''

<source lang="puppet">
class nftables(
) {
# install the package
package { 'nftables':
ensure => 'present',
}

# create a directory to hold the nftables config
file { '/etc/nftables/':
ensure => 'directory',
}

# deploy the basic configuration file, i.e, the basic nftables ruleset skeleton
file { '/etc/nftables/ruleset.nft':
ensure => 'present',
source => 'puppet:///modules/nftables/nftables.nft',
}

# ensure nftables systemd service is running (at boot time, etc)
service { 'nftables':
ensure => 'running',
}
}
</source>

We are installing this file (a file like: '''modules/nftables/files/nftables.nft''')

<source>
#!/usr/sbin/nft -f

flush ruleset

# create the basic ruleset skeleton
add table inet filter
add set inet filter allowed_ports { type inet_service ; }
add chain inet filter input { type filter hook input priority filter ; policy drop ; }
add rule inet filter input iif lo counter accept
add rule inet filter input ct state established,related counter accept
add rule inet filter input tcp dport @allowed_ports accept
add rule inet filter input counter

# include all the other files that may be deployed by puppet
include "/etc/nftables/*puppet.nft"
</source>

== a module to introduce nftables config ==

This module is responsible for injecting into the system the new nftables config.
A file named like : '''modules/nftables/manifest/rule.pp'''

<source lang="puppet">
define nftables::rule(
String $rule,
) {
require ::nftables

file { "/etc/nftables/${name}_puppet.nft":
ensure => 'present',
content => $rule,
notify => Service['nftables'],
}
}
</source>

== other modules adding nftables configuration ==

In this example, we have an apache module that creates some additional rules and configuration for nftables.
This is a file named like this: '''modules/nftables/manifest/rule.pp'''

<source lang="puppet">
class ::apache::config(
) {
package { 'apache':
ensure => 'present',
}

nftables::rule { 'apache_port_80':
rule => 'add element inet filter allowed_ports { 80 }',
}
}
</source>