playbook ansible WIP

roles/pxeserver/templates/iso/mount-all.sh

@@ -0,0 +1,9 @@
+#!/bin/bash 
+
+montami() {
+	B=$(basename $1)
+	mount "/srv/pxe/iso/$B" "/srv/pxe/mount/$B"
+	echo "mounted '/srv/pxe/iso/$B' on '/srv/pxe/mount/$B'"
+}
+export -f montami
+find /srv/pxe/mount/ -mindepth 1 -maxdepth 1 -type d -exec bash -c 'montami "$0"' {} \; 

roles/pxeserver/templates/iso/mount-isos.service

@@ -0,0 +1,8 @@
+[Unit]
+Description=Mount ISOs
+
+[Service]
+ExecStart=/srv/pxe/mount/mount-all.sh
+
+[Install]
+WantedBy=multi-user.target

roles/pxeserver/templates/rules.v4

@@ -0,0 +1,30 @@
+*filter
+:INPUT DROP [2:72]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [8441:830478]
+-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
+-A INPUT -p icmp -m state --state NEW -j ACCEPT
+-A INPUT ! -i {{ lan_iface }} -m state --state NEW -j ACCEPT
+-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
+-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
+-A INPUT -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT
+-A INPUT -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT
+-A INPUT -i {{ lan_iface }} -p udp -m state --state NEW -m udp --dport 67 -j ACCEPT
+-A INPUT -i {{ lan_iface }} -p udp -m state --state NEW -m udp --dport 69 -j ACCEPT
+-A INPUT -i {{ lan_iface }} -p tcp -m state --state NEW -m tcp --dport 111 -j ACCEPT
+-A INPUT -i {{ lan_iface }} -p udp -m state --state NEW -m udp --dport 111 -j ACCEPT
+-A INPUT -i {{ lan_iface }} -p tcp -m state --state NEW -m tcp --dport 2049 -j ACCEPT
+-A INPUT -i {{ lan_iface }} -p udp -m state --state NEW -m udp --dport 2049 -j ACCEPT
+-A INPUT -i {{ lan_iface }} -p udp -m state --state NEW -m udp --dport 4047 -j ACCEPT
+-A INPUT -i {{ lan_iface }} -p tcp -m state --state NEW -m tcp --dport 4047 -j ACCEPT
+-A INPUT -i {{ lan_iface }} -p tcp -m state --state NEW -m tcp --dport 4048 -j ACCEPT
+-A INPUT -i {{ lan_iface }} -p udp -m state --state NEW -m udp --dport 4048 -j ACCEPT
+-A FORWARD -i {{ lan_iface }} -o {{ lan_iface }} -j REJECT --reject-with icmp-port-unreachable
+COMMIT
+*nat
+:PREROUTING ACCEPT [72:10770]
+:INPUT ACCEPT [68:10030]
+:OUTPUT ACCEPT [39:2999]
+:POSTROUTING ACCEPT [1:84]
+-A POSTROUTING -o {{ wan_iface }} -j MASQUERADE
+COMMIT