second commit

ansible/roles/firewall_nftables/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: reload nftables
+  ansible.builtin.service:
+    name: nftables
+    state: restarted

ansible/roles/firewall_nftables/tasks/main.yml

@@ -0,0 +1,25 @@
+---
+# Default-Deny-Firewall (Konzept 6.7). Eingehend nur admin-SSH (aus dem
+# Management-Netz) und der oeffentliche App-/nginx-Port; ausgehend nur zu den
+# definierten Zielsystem-Netzen sowie DNS/NTP.
+
+- name: nftables installieren
+  ansible.builtin.apt:
+    name: nftables
+    state: present
+    update_cache: true
+
+- name: nftables-Regelsatz ausrollen
+  ansible.builtin.template:
+    src: jumphost.nft.j2
+    dest: /etc/nftables.conf
+    owner: root
+    group: root
+    mode: "0640"
+  notify: reload nftables
+
+- name: nftables aktivieren und starten
+  ansible.builtin.service:
+    name: nftables
+    state: started
+    enabled: true

ansible/roles/firewall_nftables/templates/jumphost.nft.j2

@@ -0,0 +1,46 @@
+#!/usr/sbin/nft -f
+flush ruleset
+
+table inet filter {
+  chain input {
+    type filter hook input priority 0; policy drop;
+
+    iif lo accept
+    ct state established,related accept
+    ct state invalid drop
+
+    icmp type echo-request limit rate 5/second accept
+    ip6 nexthdr icmpv6 icmpv6 type echo-request limit rate 5/second accept
+
+    tcp dport 22 ip saddr {{ ssh_admin_access_cidr }} accept
+
+{% if enable_nginx_proxy %}
+    tcp dport 443 accept
+{% else %}
+    tcp dport {{ jumphost_app_port }} accept
+{% endif %}
+  }
+
+  chain forward {
+    type filter hook forward priority 0; policy drop;
+  }
+
+  chain output {
+    type filter hook output priority 0; policy drop;
+
+    oif lo accept
+    ct state established,related accept
+
+    udp dport 53 accept
+    tcp dport 53 accept
+    udp dport 123 accept
+
+{% for net in target_networks %}
+    ip daddr {{ net }} accept
+{% endfor %}
+
+    # ACME/interne PKI (tls_certificates-Rolle) und OS-Paketquellen
+    tcp dport 443 accept
+    tcp dport 80 accept
+  }
+}