2026-10-03 22:40:02 +10:00
1 changed files with 9 additions and 3 deletions
@@ -18,11 +18,17 @@ profiles::dns::updater::deny_ranges:
  - 103.216.190.0/23  # wan uplink
 profiles::consul::client::host_addr: "%{hiera('networking_loopback0_ip')}"

-# ssh: keep listening on all addresses
+# ssh: listen on localhost and dum0 only; knock out the common wan primary ip
+lookup_options:
+  ssh::server::options:
+    merge:
+      strategy: deep
+      knockout_prefix: '--'
 ssh::server::options:
  ListenAddress:
-    - '0.0.0.0'
-    - '::'
+    - "--%{facts.networking.ip}"
+    - 127.0.0.1
+    - "%{hiera('networking_loopback0_ip')}"

 # frrouting
 frrouting::ospfd_router_id: "%{hiera('networking_loopback0_ip')}"