jcline/ansible
1
0
Fork 0
forked from infra/ansible
Code Pull requests Activity

base / nftables / kojibuilder: allow sign-bridge access for all builders in the secureboot group, not just x86-02/a64-02

Browse source 
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
This commit is contained in:
Kevin Fenzi 2026-05-18 15:24:12 -07:00
commit a5d7291edc
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
roles/base/templates/nftables/nftables.kojibuilder
View file

@ -87,7 +87,7 @@ add rule ip filter OUTPUT ip daddr 10.16.163.35/19 tcp sport 22 counter accept
# Allow SSHFS binding to koji01
add rule ip filter OUTPUT ip daddr 10.16.169.104 tcp dport 22 counter accept
{% endif %}
{% if inventory_hostname.startswith (('buildhw-x86-02', 'buildhw-a64-02')) %}
{% if inventory_hostname in groups['secureboot'] %}
# Allow secure boot signing to contact the sign bridge
add rule ip filter OUTPUT ip daddr 10.16.169.120 tcp dport 44334 counter accept
{% endif %}