commit 5d3598d7444c6f4dc15596219f101276d90dfd90
author Marcus Christie <machristie@apache.org> Fri Apr 16 11:39:59 2021 -0400
committer Marcus Christie <machristie@apache.org> Fri Apr 16 12:10:39 2021 -0400
tree 2aea0493c474d37cae355bd67c0d4d06c39df18c
parent e663dc6f884d9fd5c612002a33f4a7c70c00d061

Ansible: restrict access to Zabbix agent port

dev-tools/ansible/roles/env_setup/tasks/main.yml

diff --git a/dev-tools/ansible/roles/env_setup/tasks/main.yml b/dev-tools/ansible/roles/env_setup/tasks/main.yml
index bd7ba9b..bcd5327 100644
--- a/dev-tools/ansible/roles/env_setup/tasks/main.yml
+++ b/dev-tools/ansible/roles/env_setup/tasks/main.yml
@@ -71,13 +71,16 @@
   become: yes
   when: ansible_os_family == "Debian"
 
-- name: allow all networks to access zabbix
+- name: Allow subnets to access zabbix
   firewalld:
     zone: public
     permanent: yes
     state: enabled
-    port: 10050/tcp
     immediate: yes
+    rich_rule: rule family=ipv4 source address="{{ item }}" port port=10050 protocol=tcp accept
+  with_items:
+    - "{{ monitoring_subnets }}"
   become: yes
+  become_user: root
   when: ansible_os_family == "RedHat"
 ...