Enable remote access to DB to a specific IP using the ferm role

trellis
1

Hello all. I’m quite new in customising the Ansible roles provided with Trellis, so I would need some help or direction towards the right way to doing this.

We have a Trellis project that’s already in production and I need to allow a specific IP address to access the database through port 3306. Although I have found resources online that suggest how to achieve this directly with iptables rules, I would like to do this using ferm, since Trellis uses that. Also I would like to include it in the ferm role, so that this custom setting is reproducible and doesn’t get overridden by future provisions of the server. From what I understand ferm is an interface for iptables, so I guess that’s where my customisation needs to be done.

I’ve noticed that there is a templates directory in the ferm role (https://github.com/roots/trellis/tree/master/roles/ferm/templates). Is this the right place to add my custom settings? If I add any custom settings there, do I need to start with a new server or can I just re-provision the current one?

Any suggestions and help will be much appreciated!

2

You’re close :slight_smile: Thanks for letting us know where you’ve gotten to so far.

Ideally you don’t want to edit the templates within a role unless you have to. The ferm provides variables that the templates so.

So you’d want to define your own variables and override the defaults. The role README has documentation on this.

We already have examples of this here.

ferm_input_list:
  - type: dport_accept
    dport: [http, https]
    filename: nginx_accept
  - type: dport_accept
    dport: [ssh]
    saddr: "{{ ip_whitelist }}"
  - type: dport_limit
    dport: [ssh]
    seconds: 300
    hits: 20

So you’d want to add another item to that array. Something like:

ferm_input_list:
  - type: dport_accept
    dport: [http, https]
    filename: nginx_accept
  - type: dport_accept
    dport: [ssh]
    saddr: "{{ ip_whitelist }}"
  - type: dport_limit
    dport: [ssh]
    seconds: 300
    hits: 20
  - type: dport_accept
    dport: [mysql]
    saddr: "1.2.3.4"

I’m assuming mysql as a name works here.

3 Likes