65 lines
2.8 KiB
YAML
65 lines
2.8 KiB
YAML
---
|
|
# ------------------------------------------------------------------------------
|
|
# FILE: roles/llm-inference-multimodel/tasks/firewall.yml
|
|
# DESCRIPTION: Phase 3 — scope :8001 (new) and reconsider :8000 (existing
|
|
# pattern) exposure, per plan §5.
|
|
#
|
|
# Current baseline pattern (0.0.0.0:8000, no auth) is a
|
|
# pre-existing flagged issue — this role does NOT repeat it
|
|
# uncritically for the new port, and tightens both:
|
|
# 1. Bind address: handled in systemd.yml templates via
|
|
# {{ llm_bind_address }} (default 10.1.71.130, NOT 0.0.0.0).
|
|
# 2. Firewall: ufw rules scoping both ports to
|
|
# {{ llm_allowed_source_cidr }} rather than open LAN-wide.
|
|
#
|
|
# Idempotent: named rule comments + `state: present` so reruns
|
|
# don't duplicate rules (per plan §4 idempotency note).
|
|
# ------------------------------------------------------------------------------
|
|
|
|
- name: Check whether ufw is installed/active
|
|
ansible.builtin.command:
|
|
cmd: ufw status
|
|
register: llm_ufw_status
|
|
changed_when: false
|
|
failed_when: false
|
|
become: true
|
|
|
|
- name: WARNING — ufw not active, firewall scoping cannot be applied
|
|
ansible.builtin.debug:
|
|
msg: >-
|
|
ufw does not appear to be active on this host (`ufw status` returned:
|
|
{{ llm_ufw_status.stdout | default('n/a') }}). Firewall scoping for
|
|
ports {{ llm_aux_port }}/{{ llm_toolcall_port }} was skipped. This is a
|
|
gap vs plan §5 item 2 — flag to Ryan before relying on bind-address
|
|
alone for exposure control.
|
|
when: "'Status: active' not in (llm_ufw_status.stdout | default(''))"
|
|
|
|
- name: Allow aux port ({{ llm_aux_port }}) from the Hermes source subnet
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "{{ llm_aux_port | string }}"
|
|
proto: tcp
|
|
src: "{{ llm_allowed_source_cidr }}"
|
|
comment: "llm-inference-multimodel: aux (Phi-4) — scoped to Hermes subnet"
|
|
become: true
|
|
when: "'Status: active' in (llm_ufw_status.stdout | default(''))"
|
|
|
|
- name: Allow tool-calling port ({{ llm_toolcall_port }}) from the Hermes source subnet
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "{{ llm_toolcall_port | string }}"
|
|
proto: tcp
|
|
src: "{{ llm_allowed_source_cidr }}"
|
|
comment: "llm-inference-multimodel: toolcall (Mistral-Small) — scoped to Hermes subnet"
|
|
become: true
|
|
when: "'Status: active' in (llm_ufw_status.stdout | default(''))"
|
|
|
|
- name: Report firewall scoping applied
|
|
ansible.builtin.debug:
|
|
msg: >-
|
|
Firewall scoping applied for ports {{ llm_aux_port }} and
|
|
{{ llm_toolcall_port }}, restricted to source {{ llm_allowed_source_cidr }}.
|
|
Reverse-proxy + API-key enforcement (plan §5 item 3) is NOT implemented
|
|
by this role — flagged as an optional follow-up phase, not bundled into
|
|
this minimum-viable rollout.
|