<commit_before># This creates a list of firewall ssh openings in upcloud_firewall format
- name: Allow admins and deployment servers to connect into machines
  set_fact:
    upcloud_firewall_rules: >
      {{ upcloud_firewall_rules|default([]) +
        [ {
          'direction': 'in',
          'source_address_start': item,
          'source_address_end': item,
          'action': 'accept',
          'destination_port_start': '22',
          'destination_port_end': '22',
          'protocol': 'tcp',
          'family': 'IPv4'
        } ]
      }}
  with_flattened:
    - "{{ vpn_ip_list|default([]) }}"
    - "{{ deployment_server_ip_list|default([]) }}"

- name: Allow members of the cluster in the firewall
  set_fact: 
    upcloud_firewall_rules: >
      {{ upcloud_firewall_rules|default([]) +
        [ {
          'direction': 'in',
          'source_address_start': item,
          'source_address_end': item,
          'action': 'accept',
          'family': 'IPv4'
        } ]
      }}
  with_items:
    - "{{ groups['all'] }}"

- name: Allow private network (eth1) of the cluster members in the firewall
  set_fact: 
    upcloud_firewall_rules: >
      {{ upcloud_firewall_rules|default([]) +
        [ {
          'direction': 'in',
          'source_address_start': hostvars[item]['ansible_eth1']['ipv4']['address'],
          'source_address_end': hostvars[item]['ansible_eth1']['ipv4']['address'],
          'action': 'accept',
          'family': 'IPv4'
        } ]
      }}
  with_items:
    - "{{ groups['all'] }}"
  when: hostvars[item]['ansible_eth1'] is defined

# Setup firewalls using custom upcloud_firewall  directive
# source: https://github.com/UpCloudLtd/upcloud-ansible
- name: Ensure legacy firewall rules are not used
  upcloud_firewall:
    state: absent
    ip_address: "{{ item }}"
    firewall_rules: "{{ removable_legacy_firewall_rules }}"
  with_items: "{{ groups['all'] }}"
  when: removable_legacy_firewall_rules is defined

- name: Setup basic rules in firewall
  upcloud_firewall:
    state: present
    ip_address: "{{ item }}"
    firewall_rules: "{{ upcloud_firewall_rules }}"
  with_items: "{{ groups['all'] }}"

# Allow web ports only to machines with nginx
- name: Setup web ports in firewall
  upcloud_firewall:
    state: present
    ip_address: "{{ item }}"
    firewall_rules: "{{ web_firewall_rules }}"
  with_flattened:
    - "{{ groups['wundertools-dev']|default([]) }}"
    - "{{ groups['wundertools-stage']|default([]) }}"
    - "{{ groups['wundertools-prod-lb']|default([]) }}"

# Default rule is to block connections
- name: Block all other connections
  upcloud_firewall:
    state: present
    ip_address: "{{ item }}"
    firewall_rules:
      - direction: in
        action: reject
        position: 1000
  with_items: "{{ groups['all'] }}"<commit_msg>Add ability to add comments into the firewall<commit_after>- name: Allow admins to connect into servers with ssh
  set_fact:
    upcloud_firewall_rules: >
      {{ upcloud_firewall_rules|default([]) +
        [ {
          'direction': 'in',
          'source_address_start': item.1,
          'source_address_end': item.1,
          'action': 'accept',
          'destination_port_start': '22',
          'destination_port_end': '22',
          'protocol': 'tcp',
          'family': 'IPv4',
          'comment': item.0.name|default('Admin IP')
        } ]
      }}
  with_subelements:
    - "{{ vpn_ip_list }}"
    - addresses
    - flags:
      skip_missing: True

- name: Allow Deployment servers to connect into servers with ssh
  set_fact:
    upcloud_firewall_rules: >
      {{ upcloud_firewall_rules|default([]) +
        [ {
          'direction': 'in',
          'source_address_start': item.1,
          'source_address_end': item.1,
          'action': 'accept',
          'destination_port_start': '22',
          'destination_port_end': '22',
          'protocol': 'tcp',
          'family': 'IPv4',
          'comment': item.0.name|default('Deployment Server')
        } ]
      }}
  with_subelements:
    - "{{ deployment_server_ip_list }}"
    - addresses
    - flags:
      skip_missing: True

- name: Allow members of the cluster in the firewall
  set_fact: 
    upcloud_firewall_rules: >
      {{ upcloud_firewall_rules|default([]) +
        [ {
          'direction': 'in',
          'source_address_start': item,
          'source_address_end': item,
          'action': 'accept',
          'family': 'IPv4',
          'comment': 'Member of this cluster'
        } ]
      }}
  with_items:
    - "{{ groups['all'] }}"

- name: Allow private network (eth1) of the cluster members in the firewall
  set_fact: 
    upcloud_firewall_rules: >
      {{ upcloud_firewall_rules|default([]) +
        [ {
          'direction': 'in',
          'source_address_start': hostvars[item]['ansible_eth1']['ipv4']['address'],
          'source_address_end': hostvars[item]['ansible_eth1']['ipv4']['address'],
          'action': 'accept',
          'family': 'IPv4'
        } ]
      }}
  with_items:
    - "{{ groups['all'] }}"
  when: hostvars[item]['ansible_eth1'] is defined

- name: Add default rules to all machines as last rules
  set_fact:
    upcloud_firewall_rules: >
      {{ upcloud_firewall_rules + default_firewall_rules }}

# Setup firewalls using custom upcloud_firewall  directive
# source: https://github.com/UpCloudLtd/upcloud-ansible
- name: Ensure legacy firewall rules are removed
  upcloud_firewall:
    state: absent
    ip_address: "{{ item }}"
    firewall_rules: "{{ removable_legacy_firewall_rules }}"
  with_items: "{{ groups['all'] }}"
  when: removable_legacy_firewall_rules is defined

# Allow web ports only to machines with nginx
- name: Setup firewalls to all load balancer machines
  upcloud_firewall:
    state: present
    ip_address: "{{ item }}"
    firewall_rules: "{{ web_firewall_rules +  upcloud_firewall_rules }}"
  with_flattened:
    - "{{ groups['wundertools-dev']|default([]) }}"
    - "{{ groups['wundertools-stage']|default([]) }}"
    - "{{ groups['wundertools-prod-lb']|default([]) }}"

- name: Setup firewalls for the backend groups
  upcloud_firewall:
    state: present
    ip_address: "{{ item }}"
    firewall_rules: "{{ upcloud_firewall_rules }}"
  with_flattened:
    - "{{ groups['wundertools-prod-db']|default([]) }}"
    - "{{ groups['wundertools-prod-front']|default([]) }}"
{'fraction_non_alphanumeric': 0.14440603394091767, 'fraction_numerical': 0.0064424890006285354, 'mean_word_length': 2.864602307225258, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 11, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3865746', 'n_tokens_mistral': 2053, 'n_tokens_neox': 2021, 'n_words': 423}