nftables: Remove zabbix rules. Minor cleanup for jinja comments.

Signed-off-by: James Antill <james@and.org>

roles/base/templates/nftables/_nft_accept_monitoring

@@ -1,7 +1,7 @@
 # _nft_accept_monitoring
 # Default accept policy, let things be monitored
 
-# for nrpe - allow it from nocs
+# for Nagios/nrpe - allow it from nocs
 # NOTE: These were still here in staging, before the cleanup.
 #add rule {{_tn}} INPUT ip saddr 192.168.1.10  tcp dport 5666 counter accept
 #add rule {{_tn}} INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept
@@ -13,12 +13,22 @@ add rule {{_tn}} INPUT ip saddr 10.16.163.10  tcp dport 5666 counter accept
 # NOTE: This was in staging only, before the cleanup. But seems dead.
 #add rule {{_tn}} INPUT ip saddr 10.16.166.10  tcp dport 5666 counter accept
 
+#  Greg has configured zabbix so the host calls out to the server, so we
+# shouldn't need to accept anything on 10050/10051.
+#  Leaving them here commented out for a bit. 2026-06-03
+#  Hopefully Nagios dies completely soon and we can then just not include this
+# file anywhere.
 {% if env != 'staging' %}
 # zabbix01
-add rule {{_tn}} INPUT                        tcp dport 10051 counter accept
-add rule {{_tn}} INPUT ip saddr 10.3.163.198  tcp dport 10050 counter accept
+#add rule {{_tn}} INPUT                        tcp dport 10051 counter accept
+#add rule {{_tn}} INPUT ip saddr 10.3.163.198  tcp dport 10050 counter accept
 {% else %}
 # zabbix01.stg
-add rule {{_tn}} INPUT                       tcp dport 10051 counter accept
-add rule {{_tn}} INPUT ip saddr 10.16.166.61 tcp dport 10050 counter accept
+#add rule {{_tn}} INPUT                       tcp dport 10051 counter accept
+#add rule {{_tn}} INPUT ip saddr 10.16.166.61 tcp dport 10050 counter accept
 {% endif %}
+#  Some hosts aren't in staging but speak to staging, and/or zabbix.vpn for
+# vpn hosts. The name is resolved, but maybe firewall is done before VPN is
+# up and this would need to be in /etc/hosts ... none of it matters due to
+# it all being host intitiated though.
+#add rule {{_tn}} INPUT ip saddr {{zabbix_host}} tcp dport 10050 counter accept

roles/base/templates/nftables/nftables

@@ -1,11 +1,13 @@
 # {{ ansible_managed }}
 # {{ template_path }}
 
+{#
 # NOTE: This needs to be done at the top level because include inherits
 #       variables, but set variables don't escape.
 # Set small Table Names.
 # We need the big global ones so we can use them in *_rules but, that would be
 # a lot in these files.
+#}
 {% set _tn = nft_table_filter %}
 {% set _tnat = nft_table_nat %}
 

roles/base/templates/nftables/nftables-ipv6

@@ -1,8 +1,15 @@
 # {{ ansible_managed }}
+# {{ template_path }}
 
+# ############################################################################
+# NOTE: If we start using ipv6, then this should be split out and use includes.
+# ############################################################################
+
+{#
 # Set small Table Names.
 # We need the big global ones so we can use them in *_rules but, that would be
 # a lot in these files.
+#}
 {% set _tn6 = nft_table6_filter %}
 
 add table {{_tn6}}

roles/base/templates/nftables/nftables.bastion

@@ -1,9 +1,11 @@
 # {{ ansible_managed }}
 # {{ template_path }}
 
+{#
 # Set small Table Names.
 # We need the big global ones so we can use them in *_rules but, that would be
 # a lot in these files.
+#}
 {% set _tn = nft_table_filter %}
 {% set _tnat = nft_table_nat %}
 

roles/base/templates/nftables/nftables.kojibuilder

@@ -1,9 +1,11 @@
 # {{ ansible_managed }}
 # {{ template_path }}
 
+{#
 # Set small Table Names.
 # We need the big global ones so we can use them in *_rules but, that would be
 # a lot in these files.
+#}
 {% set _tn = nft_table_filter %}
 {% set _tnat = nft_table_nat %}
 

roles/base/templates/nftables/nftables.osuosl

@@ -1,9 +1,11 @@
 # {{ ansible_managed }}
 # {{ template_path }}
 
+{#
 # Set small Table Names.
 # We need the big global ones so we can use them in *_rules but, that would be
 # a lot in these files.
+#}
 {% set _tn = nft_table_filter %}
 {% set _tnat = nft_table_nat %}
 

roles/base/templates/nftables/nftables.releng

@@ -6,11 +6,13 @@
 # Please check with sysadmin-main before pushing out an update here.
 #
 
+{#
 # NOTE: We don't use _nft_accept_beg because INPUT policy default is drop
 
 # Set small Table Names.
 # We need the big global ones so we can use them in *_rules but, that would be
 # a lot in these files.
+#}
 {% set _tn = nft_table_filter %}
 {% set _tnat = nft_table_nat %}
 

roles/base/templates/nftables/nftables.sign

@@ -1,9 +1,11 @@
 # {{ ansible_managed }}
 # {{ template_path }}
 
+{#
 # Set small Table Names.
 # We need the big global ones so we can use them in *_rules but, that would be
 # a lot in these files.
+#}
 {% set _tn = nft_table_filter %}
 {% set _tnat = nft_table_nat %}
 

roles/base/templates/nftables/nftables.staging

@@ -1,9 +1,11 @@
 # {{ ansible_managed }}
 # {{ template_path }}
 
+{#
 # Set small Table Names.
 # We need the big global ones so we can use them in *_rules but, that would be
 # a lot in these files.
+#}
 {% set _tn = nft_table_filter %}
 {% set _tnat = nft_table_nat %}
 

roles/base/templates/nftables/nftables.torrent02.fedoraproject.org

@@ -1,9 +1,11 @@
 # {{ ansible_managed }}
 # {{ template_path }}
 
+{#
 # Set small Table Names.
 # We need the big global ones so we can use them in *_rules but, that would be
 # a lot in these files.
+#}
 {% set _tn = nft_table_filter %}
 {% set _tnat = nft_table_nat %}