From c7d2ac22d7b37a525557b4ef185d5cacdc8112d4 Mon Sep 17 00:00:00 2001
From: Magnus Root <magnusroot@inbox.ru>
Date: Thu, 9 Apr 2026 15:40:31 +0300
Subject: [PATCH] Added net.ipv4.ip_local_reserved_ports

---
 inventory/group_vars/prod.yml            |  1 +
 roles/waf_manual/handlers/main.yml       | 15 -------------
 roles/waf_manual/tasks/main.yml          | 20 -----------------
 roles/waf_manual/tasks/sysctl_modify.yml | 28 ------------------------
 roles/waf_manual/tasks/tuning_core.yml   | 19 ----------------
 5 files changed, 1 insertion(+), 82 deletions(-)
 delete mode 100755 roles/waf_manual/tasks/sysctl_modify.yml
 delete mode 100755 roles/waf_manual/tasks/tuning_core.yml

diff --git a/inventory/group_vars/prod.yml b/inventory/group_vars/prod.yml
index a2b56bb..0cd282b 100755
--- a/inventory/group_vars/prod.yml
+++ b/inventory/group_vars/prod.yml
@@ -68,6 +68,7 @@ sysctl_params:
   net.ipv4.tcp_wmem: "4096 4194394 16777216"
   net.ipv4.ip_local_port_range: "1024 65535"
   net.netfilter.nf_conntrack_max: 1048576
+  net.ipv4.ip_local_reserved_ports: "18000-23999"
 antibot_networks:
   - 
   - 
diff --git a/roles/waf_manual/handlers/main.yml b/roles/waf_manual/handlers/main.yml
index c69399a..6963225 100755
--- a/roles/waf_manual/handlers/main.yml
+++ b/roles/waf_manual/handlers/main.yml
@@ -1,21 +1,6 @@
 ---
-- name: Restart services
-  service:
-    name: "{{ item }}"
-    state: restarted
-  loop:
-    - networking
-    - ssh
-
 - name: Reload angie
   service:
     name: "angie"
     state: reloaded
-
-- name: Update apt cache
-  apt:
-    update_cache: true
-
-- name: Reload sysctl
-  command: sysctl -p
 ...
diff --git a/roles/waf_manual/tasks/main.yml b/roles/waf_manual/tasks/main.yml
index ed41f1b..fde4f3d 100755
--- a/roles/waf_manual/tasks/main.yml
+++ b/roles/waf_manual/tasks/main.yml
@@ -1,11 +1,4 @@
 ---
-- name: Tuning core
-  ansible.builtin.include_tasks: tuning_core.yml
-
-- name: Install certs for Angie and PT AF Nginx
-  ansible.builtin.include_role:
-    name: certs_settings
-
 - name: Check free ports
   ansible.builtin.include_tasks: find_free_ports.yml
 
@@ -15,19 +8,6 @@
 - name: Nginx in Docker settings
   ansible.builtin.include_tasks: add_nginx_conf_for_docker.yml
 
-- name: Sysctl modify
-  ansible.builtin.include_tasks: sysctl_modify.yml
-
-- name: Fluent-bit install
-  ansible.builtin.include_role:
-    name: fluent_bit_install
-  when: app_config[app].FLUENT_BIT_NEED
-
-- name: Auspex install
-  ansible.builtin.include_role:
-    name: auspex
-  ignore_errors: true
-
 - name: Docker PTAF run
   ansible.builtin.include_tasks: docker_ptaf_run.yml
 ...
diff --git a/roles/waf_manual/tasks/sysctl_modify.yml b/roles/waf_manual/tasks/sysctl_modify.yml
deleted file mode 100755
index 0449121..0000000
--- a/roles/waf_manual/tasks/sysctl_modify.yml
+++ /dev/null
@@ -1,28 +0,0 @@
----
-- name: Sysctl modify service copy
-  ansible.builtin.copy:
-    src: files/sysctl-modify-parameters.service
-    dest: /etc/systemd/system/sysctl-modify-parameters.service
-    mode: '0755'
-    owner: root
-    group: root
-  register: service_copy_result
-
-- name: Sysctl modify script copy
-  ansible.builtin.copy:
-    src: files/sysctl-modify-parameters.sh
-    dest: /usr/local/bin/sysctl-modify-parameters.sh
-    mode: '0755'
-    owner: root
-    group: root
-  register: script_copy_result
-
-- name: Enable and start service
-  ansible.builtin.systemd:
-    name: sysctl-modify-parameters.service
-    enabled: true
-    state: started
-    daemon_reload: true
-  ignore_errors: "{{ ansible_check_mode }}"
-  when: service_copy_result.changed or script_copy_result.changed
-...
diff --git a/roles/waf_manual/tasks/tuning_core.yml b/roles/waf_manual/tasks/tuning_core.yml
deleted file mode 100755
index 719303a..0000000
--- a/roles/waf_manual/tasks/tuning_core.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: Backup sysctl
-  ansible.builtin.copy:
-    src: /etc/sysctl.conf
-    dest: /etc/sysctl.conf.backup
-    remote_src: true
-
-- name: Load conntrack module
-  ansible.builtin.modprobe:
-    name: nf_conntrack
-    state: present
-
-- name: Tuning core
-  ansible.builtin.sysctl:
-    name: "{{ item.key }}"
-    value: "{{ item.value }}"
-  loop: "{{ sysctl_params | dict2items }}"
-  notify: Reload sysctl
-...