add nftables rule for port 9000

ooni · Jan 17, 2025 · 892aaf6 · 892aaf6
1 parent 28466f8
commit 892aaf6
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 0 deletions.
diff --git a/ansible/roles/clickhouse_proxy/handlers/main.yml b/ansible/roles/clickhouse_proxy/handlers/main.yml
@@ -13,3 +13,9 @@
   service:
     name: nginx
     state: reloaded
+
+- name: reload nftables
+  tags: nftables
+  ansible.builtin.systemd_service:
+    name: nftables
+    state: reloaded
diff --git a/ansible/roles/clickhouse_proxy/tasks/main.yml b/ansible/roles/clickhouse_proxy/tasks/main.yml
@@ -1,4 +1,14 @@
 ---
+- name: Allow traffic on port 9000
+  tags: clickhouse-proxy
+  blockinfile:
+    path: /etc/ooni/nftables/tcp/9000.nft
+    create: yes
+    block: |
+      add rule inet filter input tcp dport 9000 counter accept comment "clickhouse"
+  notify:
+    - reload nftables  
+
 - name: Create the modules-enabled directory if not exists
   tags: webserv
   ansible.builtin.file: