---
# For setting the etc hosts entries
ip_info:
  - ip: "{{ app_ip }}"
    hostname: "{{ app_hostname }}"

### Used by the install_local_deb_pkgs role ###
local_deb_packages:
  - "securedrop-keyring-0.1.1+{{ securedrop_app_code_version }}-amd64.deb"
  - "securedrop-config-0.1.0+{{ securedrop_app_code_version }}-amd64.deb"
  - "securedrop-ossec-server-2.8.2+{{ securedrop_app_code_version }}-amd64.deb"
  - ossec-server-2.8.2-amd64.deb

# Configure the tor hidden services. The Monitor server has only one,
# for SSH, since no web interfaces.
tor_instances:
  - service: ssh
    filename: mon-ssh-aths

authd_iprules:
  - chain: INPUT
    dest: "{{ app_hostname  }}"
    proto: tcp
    dest_port: 1515
    match: state
    cstate: "NEW,ESTABLISHED,RELATED"
    jump: ACCEPT

  - chain: OUTPUT
    source: "{{ app_hostname }}"
    proto: tcp
    source_port: 1515
    match: state
    cstate: "ESTABLISHED,RELATED"
    jump: ACCEPT

# Declare Monitor Server as OSSEC server role.
ossec_is_server: yes

---
# For setting the etc hosts entries
ip_info:
  - ip: "{{ app_ip }}"
    hostname: "{{ app_hostname }}"

### Used by the install_local_deb_pkgs role ###
local_deb_packages:
  - "securedrop-keyring-0.1.1+{{ securedrop_app_code_version }}-amd64.deb"
  - "securedrop-config-0.1.0+{{ securedrop_app_code_version }}-amd64.deb"
  - "securedrop-ossec-server-2.8.2+{{ securedrop_app_code_version }}-amd64.deb"
  - ossec-server-2.8.2-amd64.deb

# Configure the tor hidden services. The Monitor server has only one,
# for SSH, since no web interfaces.
tor_instances:
  - service: ssh
    filename: mon-ssh-aths

authd_iprules:
  - chain: INPUT
    source: "{{ app_hostname  }}"
    proto: tcp
    dest_port: 1515
    match: state
    cstate: "NEW,ESTABLISHED,RELATED"
    jump: ACCEPT

  - chain: OUTPUT
    dest: "{{ app_hostname }}"
    proto: tcp
    source_port: 1515
    match: state
    cstate: "ESTABLISHED,RELATED"
    jump: ACCEPT

# Declare Monitor Server as OSSEC server role.
ossec_is_server: yes

Add fix for iptables OSSEC monitor temporary rules
Add fix for iptables OSSEC monitor temporary rules

The previous iptables rules were swapped and caused the port to be
blocked during registration.

(cherry picked from commit 4c012fa8bb6c6186cb91fb2b00e9650655201e07)
