Added net.ipv4.ip_local_reserved_ports

inventory/group_vars/prod.yml

@@ -68,6 +68,7 @@ sysctl_params:
   net.ipv4.tcp_wmem: "4096 4194394 16777216"
   net.ipv4.ip_local_port_range: "1024 65535"
   net.netfilter.nf_conntrack_max: 1048576
+  net.ipv4.ip_local_reserved_ports: "18000-23999"
 antibot_networks:
   - 
   - 

roles/waf_manual/handlers/main.yml

@@ -1,21 +1,6 @@
 ---
-- name: Restart services
-  service:
-    name: "{{ item }}"
-    state: restarted
-  loop:
-    - networking
-    - ssh
-
 - name: Reload angie
   service:
     name: "angie"
     state: reloaded
-
-- name: Update apt cache
-  apt:
-    update_cache: true
-
-- name: Reload sysctl
-  command: sysctl -p
 ...

roles/waf_manual/tasks/main.yml

@@ -1,11 +1,4 @@
 ---
-- name: Tuning core
-  ansible.builtin.include_tasks: tuning_core.yml
-
-- name: Install certs for Angie and PT AF Nginx
-  ansible.builtin.include_role:
-    name: certs_settings
-
 - name: Check free ports
   ansible.builtin.include_tasks: find_free_ports.yml
 
@@ -15,19 +8,6 @@
 - name: Nginx in Docker settings
   ansible.builtin.include_tasks: add_nginx_conf_for_docker.yml
 
-- name: Sysctl modify
-  ansible.builtin.include_tasks: sysctl_modify.yml
-
-- name: Fluent-bit install
-  ansible.builtin.include_role:
-    name: fluent_bit_install
-  when: app_config[app].FLUENT_BIT_NEED
-
-- name: Auspex install
-  ansible.builtin.include_role:
-    name: auspex
-  ignore_errors: true
-
 - name: Docker PTAF run
   ansible.builtin.include_tasks: docker_ptaf_run.yml
 ...

roles/waf_manual/tasks/sysctl_modify.yml

@@ -1,28 +0,0 @@
----
-- name: Sysctl modify service copy
-  ansible.builtin.copy:
-    src: files/sysctl-modify-parameters.service
-    dest: /etc/systemd/system/sysctl-modify-parameters.service
-    mode: '0755'
-    owner: root
-    group: root
-  register: service_copy_result
-
-- name: Sysctl modify script copy
-  ansible.builtin.copy:
-    src: files/sysctl-modify-parameters.sh
-    dest: /usr/local/bin/sysctl-modify-parameters.sh
-    mode: '0755'
-    owner: root
-    group: root
-  register: script_copy_result
-
-- name: Enable and start service
-  ansible.builtin.systemd:
-    name: sysctl-modify-parameters.service
-    enabled: true
-    state: started
-    daemon_reload: true
-  ignore_errors: "{{ ansible_check_mode }}"
-  when: service_copy_result.changed or script_copy_result.changed
-...

roles/waf_manual/tasks/tuning_core.yml

@@ -1,19 +0,0 @@
----
-- name: Backup sysctl
-  ansible.builtin.copy:
-    src: /etc/sysctl.conf
-    dest: /etc/sysctl.conf.backup
-    remote_src: true
-
-- name: Load conntrack module
-  ansible.builtin.modprobe:
-    name: nf_conntrack
-    state: present
-
-- name: Tuning core
-  ansible.builtin.sysctl:
-    name: "{{ item.key }}"
-    value: "{{ item.value }}"
-  loop: "{{ sysctl_params | dict2items }}"
-  notify: Reload sysctl
-...