Add basic UFW rules

README.md

@@ -16,7 +16,9 @@ requirements.txt                     # Python requirements
 1. Create a virtual environment: `python -m venv venv`
 1. Activate the virtual environment
    - Windows: `.\venv\Scripts\activate`
+    - Note: [Ansible cannot run on Windows hosts natively](https://docs.ansible.com/ansible/latest/user_guide/windows_faq.html#can-ansible-run-on-windows)
    - Linux: `source venv/bin/activate`
 1. Update pip and builder deps: `python -m pip install --upgrade pip wheel setuptools`
 1. Install project dependancies: `python -m pip install -r requirements.txt`
 1. Install the pre-commit hook: `pre-commit install`
+1. Create a `vault_passwords` file and write the vault password to it

inventory.yaml

@@ -15,3 +15,5 @@ all:
     neumann:
       ansible_host: neumann.box.pydis.wtf
       wireguard_subnet: 10.5.0.0/16
+  vars:
+    wireguard_port: 46850

playbook.yml

@@ -10,6 +10,12 @@
   tags:
     - jumpcloud
 
+- hosts: all
+  roles:
+    - ufw
+  tags:
+    - ufw
+
 - hosts: all
   roles:
     - wireguard

roles/ufw/tasks/main.yml

@@ -0,0 +1,27 @@
+- name: Install UFW
+  apt:
+    update_cache: true
+    cache_valid_time: 3600
+    pkg:
+      - ufw
+
+- name: Allow OpenSSH
+  community.general.ufw:
+    rule: allow
+    name: OpenSSH
+
+- name: Enable UFW and deny all traffic by default
+  community.general.ufw:
+    state: enabled
+    policy: deny
+
+- name: Allow WireGuard
+  community.general.ufw:
+    rule: allow
+    proto: udp
+    port: "{{ wireguard_port }}"
+    comment: "Allow WireGuard"
+
+- name: Apply service-specific rules
+  community.general.ufw: "{{ item }}"
+  with_items: "{{ rules }}"

roles/ufw/vars/main.yml

@@ -0,0 +1 @@
+rules: []

roles/wireguard/templates/wg0.conf.j2

@@ -1,15 +1,15 @@
 # Configuration managed by Ansible
 [Interface]
 Address = {{ wireguard_subnet }}
-ListenPort = 46850
+ListenPort = {{ wireguard_port }}
 PrivateKey = {{ wg_priv_key['content'] | b64decode | trim }}
 
 {% for host in hostvars.keys() if not host == inventory_hostname %}
 # Peer config for: {{ host }}
 [Peer]
 AllowedIPs = {{ hostvars[host]['wireguard_subnet'] }}
 PublicKey = {{ hostvars[host]['wg_pub_key']['content'] | b64decode | trim }}
-Endpoint = {{ host }}.box.pydis.wtf:46850
+Endpoint = {{ host }}.box.pydis.wtf:{{ wireguard_port }}
 PersistentKeepalive = 30
 
 {% endfor %}