{"id":19647880,"url":"https://github.com/nl2go/ansible-role-hetzner-firewall","last_synced_at":"2025-04-28T15:32:18.654Z","repository":{"id":101457620,"uuid":"220325590","full_name":"nl2go/ansible-role-hetzner-firewall","owner":"nl2go","description":"An Ansible Role that manages Hetzner Robot Firewall","archived":false,"fork":false,"pushed_at":"2020-02-13T06:43:55.000Z","size":85,"stargazers_count":12,"open_issues_count":1,"forks_count":1,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-04-05T09:25:00.274Z","etag":null,"topics":["ansible-role","firewall","hetzner","hetzner-robot-api"],"latest_commit_sha":null,"homepage":"https://galaxy.ansible.com/nl2go/hetzner_firewall","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/nl2go.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-11-07T20:43:29.000Z","updated_at":"2024-07-06T23:13:38.000Z","dependencies_parsed_at":null,"dependency_job_id":"501ae8b7-aec2-4a07-96a0-9c60f2b2f4a8","html_url":"https://github.com/nl2go/ansible-role-hetzner-firewall","commit_stats":null,"previous_names":[],"tags_count":5,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nl2go%2Fansible-role-hetzner-firewall","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nl2go%2Fansible-role-hetzner-firewall/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nl2go%2Fansible-role-hetzner-firewall/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nl2go%2Fansible-role-hetzner-firewall/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nl2go","download_url":"https://codeload.github.com/nl2go/ansible-role-hetzner-firewall/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":251338797,"owners_count":21573613,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ansible-role","firewall","hetzner","hetzner-robot-api"],"created_at":"2024-11-11T14:46:18.228Z","updated_at":"2025-04-28T15:32:18.600Z","avatar_url":"https://github.com/nl2go.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"[![Travis (.org) branch](https://img.shields.io/travis/nl2go/ansible-role-hetzner-firewall/master)](https://travis-ci.org/nl2go/ansible-role-hetzner-firewall)\n[![Codecov](https://img.shields.io/codecov/c/github/nl2go/ansible-role-hetzner-firewall)](https://codecov.io/gh/nl2go/ansible-role-hetzner-firewall)\n[![Ansible Galaxy](https://img.shields.io/badge/role-nl2go.hetzner_firewall-blue.svg)](https://galaxy.ansible.com/nl2go/hetzner_firewall/)\n[![GitHub tag (latest by date)](https://img.shields.io/github/v/tag/nl2go/ansible-role-hetzner-firewall)](https://galaxy.ansible.com/nl2go/hetzner_firewall)\n[![Ansible Galaxy Downloads](https://img.shields.io/ansible/role/d/44723.svg?color=blue)](https://galaxy.ansible.com/nl2go/hetzner_firewall/)\n\n# Ansible Role: Hetzner Firewall\n\nAn Ansible Role that manages [Hetzner Robot Firewall](https://wiki.hetzner.de/index.php/Robot_Firewall/en).\n\n## Prerequisites\n\n- Existing [Hetzner Online GmbH Account](https://accounts.hetzner.com).\n- Configured [Hetzner Robot Webservice Account](https://robot.your-server.de/preferences).\n\n## Requirements\n\n| Name | Type | Version | Location |\n|---|---|---|---|\n| [ansible-filter](https://github.com/nl2go/ansible-filter) | Python package | 1.0.1 | Control node |\n\n## Role Variables\n\nAvailable variables are listed below, along with default values (see `defaults/main.yml`):\n\n    hetzner_firewall_webservice_base_url: https://robot-ws.your-server.de\n \nBase url that is pointing to the [Hetzner Robot API](https://robot.your-server.de/doc/webservice/de.html). The variable is mostly utilized for testing purposes, there\nis no need to change the default.\n\n    hetzner_firewall_webservice_username: robot\n    \nWebservice login name. May be set/changed as described in the section [Change Access Data (Hetzner Wiki)](https://wiki.hetzner.de/index.php/KonsoleH:Zugangsdaten_aendern/en).\n\n    hetzner_firewall_webservice_password: secret\n    \nWebservice password. May be set/changed as described in the section [Change Access Data (Hetzner Wiki)](https://wiki.hetzner.de/index.php/KonsoleH:Zugangsdaten_aendern/en).\n\n    hetzner_firewall_templates:\n      - name: New Template\n        whitelist_hos: true\n        is_default: false\n        rules:\n          input:\n            - action: accept\n              ip_version: ipv4\n              name: Allow all\n    \nMultiple firewall templates may be managed using `hetzner_firewall_templates` variable. A firewall template is \nidentified by the `name` attribute. The name must be unique to omit collision/unexpected behavior. \nThe `state` attribute for a template defaults to `present`.\n\n    hetzner_firewall_templates:\n      - name: New Template\n        state: absent\n\nTo ensure the template is removed add `state: absent`. The `name` attribute remains mandatory to identify origin state.\n\n    hetzner_firewall_host:\n        name: New Template\n\nHost firewall may be managed by referencing an existing firewall template from the `hetzner_firewall_templates` list.\nThe variable `hetzner_firewall_host` may be defined for a particular host group or a dedicated host. Undefined `hetzner_firewall_host`\nleaves the related host or host group firewall being ignored by the role.\n\n    hetzner_firewall_host:\n        absent: true\n\nTo remove the firewall configuration for a particular host add `state: absent` to the host firewall configuration.\nAdditional configuration parameters do not take effect when `state: absent` is provided.\n\n    hetzner_firewall_host:\n        status: disabled\n\nTo disable the firewall for configuration for a particular host add `status: disabled` to the host firewall configuration.\nAdditional configuration parameters do not take effect when `state: disabled` is provided.                \n\n    hetzner_firewall_webservice_concurrent_requests: 1\n    hetzner_firewall_webservice_concurrent_poll: 1\n    \nTo speed up the role execution while handling the firewall configuration for a big amount of hosts, the number of parallel requests made to the Hetzner Robot API\ncan be controlled by `hetzner_firewall_webservice_concurrent_requests` variable. The poll interval for asynchronous request\nresult processing is set using `hetzner_firewall_webservice_concurrent_poll`. Check official documentation on\n[Asynchronous Actions and Polling](https://docs.ansible.com/ansible/latest/user_guide/playbooks_async.html) for more explanation. \n\n## Tags\n\nTags can be used to limit the role execution to a particular task module. Following tags are available:\n\n- `hetzner_firewall`,`config`: Covers the full role lifecycle.\n- `hetzner_firewall_template`: Manages firewall templates.\n- `hetzner_firewall_host`: Manages hosts firewall.\n\n## Dependencies\n\nNone.\n\n## Example Playbook\n\n    - hosts: all\n      roles:\n         - nl2go.hetzner_firewall\n         \n## Example Configuration\n\n    hetzner_firewall_templates:\n      - name: Real World Template\n        whitelist_hos: true\n        is_default: true\n        rules:\n          input:\n            - name: Allow ICMP\n              action: accept\n              ip_version: ipv4\n              protocol: icmp\n            - name: Allow TCP based downloads\n              action: accept\n              ip_version: ipv4\n              protocol: tcp\n              dst_port: 32768-65535\n              tcp_flags: syn\n            - name: Allow UDP based downloads\n              action: accept\n              ip_version: ipv4\n              protocol: tcp\n              dst_port: 32768-65535\n            - name: Allow SSH Office IP\n              action: accept\n              ip_version: ipv4\n              protocol: tcp\n              src_ip: 1.1.1.1/32\n              dst_port: '22'\n            - name: Allow private range 1\n              action: accept\n              ip_version: ipv4\n              src_ip: 10.0.0.0/8\n              \n## Development\nUse [docker-molecule](https://github.com/nl2go/docker-molecule) following the instructions to run [Molecule](https://molecule.readthedocs.io/en/stable/)\nor install [Molecule](https://molecule.readthedocs.io/en/stable/) locally (not recommended, version conflicts might appear).\n\n\nUse following to run tests:\n\n    molecule test --all\n       \nThis role relies on [hetzner-robot-api-mock](https://github.com/nl2go/hetzner-robot-api-mock) to simulate interactions with\nthe [Hetzner Robot API](https://robot.your-server.de/doc/webservice/de.html).\n\n## Maintainers\n\n- [build-failure](https://github.com/build-failure)\n\n## License\n\nSee the [LICENSE.md](LICENSE.md) file for details.\n\n## Author Information\n\nThis role was created by in 2019 by [Newsletter2Go GmbH](https://www.newsletter2go.com/).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnl2go%2Fansible-role-hetzner-firewall","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnl2go%2Fansible-role-hetzner-firewall","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnl2go%2Fansible-role-hetzner-firewall/lists"}