victorkoycheff/ansible
1
0
Fork 0
forked from infra/ansible
Code Pull requests Activity

base / nftables / builders: allow secure boot signing builders to talk to sign bridge

Browse source 
The builders that sign for secure boot need to talk to the
sigul-bridgd01 server to sign things.

Signed-off-by: Kevin Fenzi <kevin@scrye.com>
This commit is contained in:
Kevin Fenzi 2026-02-24 15:29:33 -08:00
commit d77eae4e33
1 changed files with 4 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
roles/base/templates/nftables/nftables.kojibuilder
View file

@ -87,6 +87,10 @@ add rule ip filter OUTPUT ip daddr 10.16.163.35/19 tcp sport 22 counter accept
# Allow SSHFS binding to koji01
add rule ip filter OUTPUT ip daddr 10.16.169.104 tcp dport 22 counter accept
{% endif %}
{% if inventory_hostname.startswith (('buildhw-x86-02', 'buildhw-a64-02')) %}
# Allow secure boot signing to contact the sign bridge
add rule ip filter OUTPUT ip daddr 10.16.169.120 tcp dport 44334 counter accept
{% endif %}
# http to pull sources from pkgs lookaside
#add rule ip filter OUTPUT ip daddr 10.5.125.44 tcp dport 80 counter accept