From f4f4a12b52e1e54f82292cdd3d62d13dfda7ee53 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 3 Oct 2026 20:44:56 +1000 Subject: [PATCH] pin prodnxsr0020 sshd to localhost and dum0 --- hieradata/nodes/prodnxsr0020.main.unkin.net.yaml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/hieradata/nodes/prodnxsr0020.main.unkin.net.yaml b/hieradata/nodes/prodnxsr0020.main.unkin.net.yaml index d404eb5..9ac160e 100644 --- a/hieradata/nodes/prodnxsr0020.main.unkin.net.yaml +++ b/hieradata/nodes/prodnxsr0020.main.unkin.net.yaml @@ -18,11 +18,17 @@ profiles::dns::updater::deny_ranges: - 103.216.190.0/23 # wan uplink profiles::consul::client::host_addr: "%{hiera('networking_loopback0_ip')}" -# ssh: keep listening on all addresses +# ssh: listen on localhost and dum0 only; knock out the common wan primary ip +lookup_options: + ssh::server::options: + merge: + strategy: deep + knockout_prefix: '--' ssh::server::options: ListenAddress: - - '0.0.0.0' - - '::' + - "--%{facts.networking.ip}" + - 127.0.0.1 + - "%{hiera('networking_loopback0_ip')}" # frrouting frrouting::ospfd_router_id: "%{hiera('networking_loopback0_ip')}"