<commit_before>---

external_interface: "em1"
ext_net_addr: "192.168.3.11"
ext_ip_addr: "172.16.17.32"
ext_net_mask: "255.255.255.0"
ext_gateway: "192.168.127.12"

internal_interface: "em2"
int_net_addr: "10.0.0.0"
int_ip_addr: "10.1.1.1"
int_net_mask: "255.0.0.0"
int_gateway: "10.1.1.4"

internal_net: "10.0.0.0/8"

network_ether_interfaces:
  - device: "{{external_interface}}"
    bootproto: "static"
    onboot: "yes"
    netmask: "{{ext_net_mask}}"
    gateway: "{{ext_gateway}}"
    defroute: "yes"
    nm_controlled: "no"
    type: "Ethernet"

  - device: "{{internal_interface}}"
    bootproto: "static"
    onboot: "yes"
    nm_controlled: "no"
    type: "Ethernet"

network_bridge_interfaces:
  - device: "br_ext"
    type: "Bridge"
    bootproto: "static"
    onboot: "yes"
    #stp: "on"
    address: "{{ext_ip_addr}}"
    netmask: "{{ext_net_mask}}"
    gateway: "{{ext_gateway}}"
    ports: ["{{external_interface}}"]
    nm_controlled: "no"
    route:
      - network: "{{ext_net_addr}}"
        netmask: "{{ext_net_mask}}"
        gateway: "{{ext_gateway}}"

  - device: "br_int"
    type: "Bridge"
    bootproto: "static"
    onboot: "yes"
    #stp: "on"
    address: "{{int_ip_addr}}"
    netmask: "{{int_net_mask}}"
    ports: ["{{internal_interface}}"]
    nm_controlled: "no"

# Ferm - firewall - replaces the default from all/all
ferm_rules:
 05_ssh:
 - chain: INPUT
   domains: [ip, ip6]
   rules:
     - {rule: "policy DROP;",  comment: "global policy"}
     - {rule: "mod state state INVALID DROP;", comment: "connection tracking: drop"}
     - {rule: "mod state state (ESTABLISHED RELATED) ACCEPT;", comment: "connection tracking"}
     - {rule: "interface lo ACCEPT;", comment: "allow local packet"}
     - {rule: "proto icmp ACCEPT;", comment: "respond to ping"}
     - {rule: "proto tcp dport (22) saddr ( {{ trusted_public_networks }} {{ trusted_public_ipv6_networks }} )mod comment comment 'SSH' ACCEPT;", comment: "SSH"}
     - {rule: "proto tcp dport (514 123) interface ( br_int ib0 ib1 ) mod comment comment 'TCP Accept Rsyslog and NTP from internal net' ACCEPT;", comment: "internal"}
     - {rule: "proto udp dport (514 123) interface ( br_int ib0 ib1 ) mod comment comment 'UDP Accept Rsyslog and NTP from internal net' ACCEPT;", comment: "internal"}
 - chain: OUTPUT
   domains:
     - ip
     - ip6
   rules:
     - rule: "policy ACCEPT;"
       comment: global policy
 - chain: FORWARD
   domains: [ip, ip6]
   rules:
     - rule: "policy DROP;"
       comment: global policy
     - rule: "mod state state INVALID DROP;"
       comment: "connection tracking: drop"
     - rule: "mod state state (ESTABLISHED RELATED) ACCEPT;"
       comment: "connection tracking"
# These extra rules for the admin node are for hypervisor traffic forwarding
ferm_rules_extra:
 hypervisor:
 - chain: FORWARD
   table: filter
   domains: [ip, ip6]
   rules:
     - {rule: "interface br_int outerface br_ext mod state state (ESTABLISHED RELATED) mod comment comment 'forward establish and related' ACCEPT;", comment: "forwarding"}
     - {rule: "interface br_ext outerface br_int mod state state (ESTABLISHED RELATED) mod comment comment 'forward from internal net' ACCEPT;", comment: "forwarding"}
 - chain: POSTROUTING
   table: nat
   domains: [ip]
   rules:
     - {rule: "daddr ( {{ trusted_public_networks }} {{ internal_net }} ) mod comment comment 'masquerade for internal net' ACCEPT;", comment: "masquerade"}
     - {rule: "outerface br_ext saddr ( {{ internal_net }} ) mod comment comment 'masquerade for internal net' MASQUERADE;", comment: "masquerade"}
 - chain: PREROUTING
   table: nat
   domains: [ip]
   rules:
     - {rule: "saddr ( {{ trusted_public_networks }} {{ internal_net }} ) mod comment comment 'masquerade for internal net' ACCEPT;", comment: "masquerade"}
 - chain: PREROUTING
   table: mangle
   domains: [ip]
   rules:
     - {rule: "saddr ( {{ trusted_public_networks }} {{ internal_net }} ) mod comment comment 'masquerade for internal net' ACCEPT;", comment: "masquerade"}

# SSHD

sshd:
 AllowGroups: "root admin" 

# Install these package
unconfigured_packages:
 - "virt-install"
 - "qemu-kvm"
 - "vim-enhanced"
 - "yum-plugin-priorities"
 - "glx-utils"
 - "mesa-dri-drivers"
 - "plymouth-system-theme"
 - "spice-vdagent"
 - "xorg-x11-drivers"
 - "xorg-x11-server-Xorg"
 - "xorg-x11-utils"
 - "xorg-x11-xauth"
 - "xorg-x11-xinit"
 - "xvattr"
 - "dejavu-lgc-sans-fonts"

# Admin node receives syslog from cluster nodes
central_log_listener: True
central_logs_directory: "/var/log/remote/servers"
central_logs_retention_days: 60<commit_msg>install wget and pciutils on admin node<commit_after>---

external_interface: "em1"
ext_net_addr: "192.168.3.11"
ext_ip_addr: "172.16.17.32"
ext_net_mask: "255.255.255.0"
ext_gateway: "192.168.127.12"

internal_interface: "em2"
int_net_addr: "10.0.0.0"
int_ip_addr: "10.1.1.1"
int_net_mask: "255.0.0.0"
int_gateway: "10.1.1.4"

internal_net: "10.0.0.0/8"

network_ether_interfaces:
  - device: "{{external_interface}}"
    bootproto: "static"
    onboot: "yes"
    netmask: "{{ext_net_mask}}"
    gateway: "{{ext_gateway}}"
    defroute: "yes"
    nm_controlled: "no"
    type: "Ethernet"

  - device: "{{internal_interface}}"
    bootproto: "static"
    onboot: "yes"
    nm_controlled: "no"
    type: "Ethernet"

network_bridge_interfaces:
  - device: "br_ext"
    type: "Bridge"
    bootproto: "static"
    onboot: "yes"
    #stp: "on"
    address: "{{ext_ip_addr}}"
    netmask: "{{ext_net_mask}}"
    gateway: "{{ext_gateway}}"
    ports: ["{{external_interface}}"]
    nm_controlled: "no"
    route:
      - network: "{{ext_net_addr}}"
        netmask: "{{ext_net_mask}}"
        gateway: "{{ext_gateway}}"

  - device: "br_int"
    type: "Bridge"
    bootproto: "static"
    onboot: "yes"
    #stp: "on"
    address: "{{int_ip_addr}}"
    netmask: "{{int_net_mask}}"
    ports: ["{{internal_interface}}"]
    nm_controlled: "no"

# Ferm - firewall - replaces the default from all/all
ferm_rules:
 05_ssh:
 - chain: INPUT
   domains: [ip, ip6]
   rules:
     - {rule: "policy DROP;",  comment: "global policy"}
     - {rule: "mod state state INVALID DROP;", comment: "connection tracking: drop"}
     - {rule: "mod state state (ESTABLISHED RELATED) ACCEPT;", comment: "connection tracking"}
     - {rule: "interface lo ACCEPT;", comment: "allow local packet"}
     - {rule: "proto icmp ACCEPT;", comment: "respond to ping"}
     - {rule: "proto tcp dport (22) saddr ( {{ trusted_public_networks }} {{ trusted_public_ipv6_networks }} )mod comment comment 'SSH' ACCEPT;", comment: "SSH"}
     - {rule: "proto tcp dport (514 123) interface ( br_int ib0 ib1 ) mod comment comment 'TCP Accept Rsyslog and NTP from internal net' ACCEPT;", comment: "internal"}
     - {rule: "proto udp dport (514 123) interface ( br_int ib0 ib1 ) mod comment comment 'UDP Accept Rsyslog and NTP from internal net' ACCEPT;", comment: "internal"}
 - chain: OUTPUT
   domains:
     - ip
     - ip6
   rules:
     - rule: "policy ACCEPT;"
       comment: global policy
 - chain: FORWARD
   domains: [ip, ip6]
   rules:
     - rule: "policy DROP;"
       comment: global policy
     - rule: "mod state state INVALID DROP;"
       comment: "connection tracking: drop"
     - rule: "mod state state (ESTABLISHED RELATED) ACCEPT;"
       comment: "connection tracking"
# These extra rules for the admin node are for hypervisor traffic forwarding
ferm_rules_extra:
 hypervisor:
 - chain: FORWARD
   table: filter
   domains: [ip, ip6]
   rules:
     - {rule: "interface br_int outerface br_ext mod state state (ESTABLISHED RELATED) mod comment comment 'forward establish and related' ACCEPT;", comment: "forwarding"}
     - {rule: "interface br_ext outerface br_int mod state state (ESTABLISHED RELATED) mod comment comment 'forward from internal net' ACCEPT;", comment: "forwarding"}
 - chain: POSTROUTING
   table: nat
   domains: [ip]
   rules:
     - {rule: "daddr ( {{ trusted_public_networks }} {{ internal_net }} ) mod comment comment 'masquerade for internal net' ACCEPT;", comment: "masquerade"}
     - {rule: "outerface br_ext saddr ( {{ internal_net }} ) mod comment comment 'masquerade for internal net' MASQUERADE;", comment: "masquerade"}
 - chain: PREROUTING
   table: nat
   domains: [ip]
   rules:
     - {rule: "saddr ( {{ trusted_public_networks }} {{ internal_net }} ) mod comment comment 'masquerade for internal net' ACCEPT;", comment: "masquerade"}
 - chain: PREROUTING
   table: mangle
   domains: [ip]
   rules:
     - {rule: "saddr ( {{ trusted_public_networks }} {{ internal_net }} ) mod comment comment 'masquerade for internal net' ACCEPT;", comment: "masquerade"}

# SSHD

sshd:
 AllowGroups: "root admin" 

# Install these package
unconfigured_packages:
 - "virt-install"
 - "qemu-kvm"
 - "vim-enhanced"
 - "yum-plugin-priorities"
 - "glx-utils"
 - "mesa-dri-drivers"
 - "plymouth-system-theme"
 - "spice-vdagent"
 - "xorg-x11-drivers"
 - "xorg-x11-server-Xorg"
 - "xorg-x11-utils"
 - "xorg-x11-xauth"
 - "xorg-x11-xinit"
 - "xvattr"
 - "dejavu-lgc-sans-fonts"
 - "wget"
 - "pciutils"

# Admin node receives syslog from cluster nodes
central_log_listener: True
central_logs_directory: "/var/log/remote/servers"
central_logs_retention_days: 60
{'fraction_non_alphanumeric': 0.14192990047598442, 'fraction_numerical': 0.022717438338381652, 'mean_word_length': 3.597215315763302, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 18, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7456159', 'n_tokens_mistral': 3457, 'n_tokens_neox': 3305, 'n_words': 881}