# Cron
logcheck_minute: 46

cron_worker:
  - { dst: "/usr/local/sbin/backup_daily",
        own: "root", grp: "root", mode: "0755", src: "server1/backup_daily" }

cron_secret:
  - { dst: "/usr/local/etc/backup_secret",
        own: "root", grp: "root", mode: "0600", src: "secret/backup_secret.j2" }

cron_prvkey:
  - { dst: "/etc/ssl/private/other.key",
        own: "root", grp: "root", mode: "0600", cnt: "{{ vault_ssh_private_key }}" }

# Fail2ban
enabled_jails:
  - recidive
  - sshd
  - apache
  - postfix

# ModSecurity2
#modsec_ruleengine: "DetectionOnly"
modsec_ruleengine: "On"

# Network range
nft_lan_ip4: "192.168.110.0/24"
nft_lan_ip6: "fdaa:aaaa:aaaa:aaaa::/64"

# Allow from lan 
nft_lan_allow_elements:
  - { proto_port: "tcp . 22",			comment: "SSH" }
  - { proto_port: "tcp . 143",			comment: "IMAP" }
  - { proto_port: "tcp . 465",			comment: "SMTP Auth" }
  - { proto_port: "tcp . 587",			comment: "Submission" }
  - { proto_port: "udp . 33434-33534",		comment: "traceroute" }

# Deny this server(input)
nft_input_silent_elements:
  - { proto_port: "udp . 67",			comment: "DHCP Request" }
  - { proto_port: "udp . 68",			comment: "DHCP Answer" }
  - { proto_port: "udp . 137",			comment: "NetBIOS Name Service(WINS)" }
  - { proto_port: "udp . 138",			comment: "NetBIOS Datagram Service" }

# Deny this server(invalid)
nft_invalid_silent_elements:
  - { proto_port: "tcp . 0-65535 . 443",	comment: "HTTPS" }