mirror of
https://gitlab.archlinux.org/archlinux/infrastructure.git
synced 2025-01-18 08:06:16 +01:00
fca14fb161
There is no reason for exposing the service to the whole internet nor communicating without encryption. It could be fixed by restricting the firewall rule to the public IP of the gitlb server and running it over HTTPS or we could just use our existing WG network. To allow gitlab to send requests to a private network address, the IP has been allowlisted[1]. The endpoint also expects a "secret token"[2], so it won't accept events from e.g. users creating a webhook with the same URL. [1] https://docs.gitlab.com/ee/security/webhooks.html#allow-outbound-requests-to-certain-ip-addresses-and-domains [2] https://docs.gitlab.com/ee/user/project/integrations/webhooks.html#validate-payloads-by-using-a-secret-token
27 lines
1.0 KiB
YAML
27 lines
1.0 KiB
YAML
- name: Install sequoia
|
|
pacman: name=sequoia-sq state=present
|
|
|
|
- name: Install systemd service
|
|
copy: src=bugbuddy.service dest="/etc/systemd/system/bugbuddy.service" owner=root group=root mode=0644
|
|
notify:
|
|
- Daemon reload
|
|
|
|
- name: Install conf file
|
|
template: src=bugbuddy.conf.j2 dest=/etc/conf.d/bugbuddy owner=root group=root mode=0600
|
|
|
|
- name: Install download script
|
|
copy: src=bugbuddy-download.sh dest=/usr/local/bin/bugbuddy-download owner=root group=root mode=0755
|
|
|
|
- name: Download latest bugbuddy # noqa no-changed-when
|
|
command: /usr/local/bin/bugbuddy-download --restart
|
|
|
|
- name: Start and enable daemon service
|
|
systemd: name=bugbuddy.service enabled=yes state=started
|
|
|
|
- name: Open bugbuddy ipv4 port for gitlab.archlinux.org
|
|
ansible.posix.firewalld: zone=wireguard state=enabled permanent=true immediate=yes
|
|
rich_rule="rule family=ipv4 source address={{ hostvars['gitlab.archlinux.org']['wireguard_address'] }} port protocol=tcp port=8080 accept"
|
|
when: configure_firewall
|
|
tags:
|
|
- firewall
|