1 files changed, 74 insertions, 0 deletions
diff --git a/files/securitygroup.sh b/files/securitygroup.sh
new file mode 100755
index 0000000..a7c2ad1
--- /dev/null
+++ b/files/securitygroup.sh
@@ -0,0 +1,74 @@
+#!/bin/bash
+
+private_network_cidr="${1}"
+public_network_cidrs="${2}"
+
+for name in default-grp; do
+    openstack security group show ${name} || openstack security group create --description "${name} ports" ${name} >/dev/null 2>&1
+    for protocol in tcp udp; do
+        if [ "openstack security group show default -f shell -c rules | grep -F 'ingress' | grep -F \"port_range_min='1'\" | grep -F \"port_range_max='65535'\" | grep -F \"${protocol}\" | grep -F 'IPv4'" == "" ]; then
+            openstack security group rule create --egress --protocol ${protocol} --remote-ip 0.0.0.0/0 --dst-port 1:65535 --ethertype IPv4 ${name} >/dev/null 2>&1
+        fi
+        if [ "openstack security group show default -f shell -c rules | grep -F 'ingress' | grep -F \"port_range_min='1'\" | grep -F \"port_range_max='65535'\" | grep -F \"${protocol}\" | grep -F 'IPv6'" == "" ]; then
+            openstack security group rule create --egress --protocol ${protocol} --remote-ip ::/0 --dst-port 1:65535 --ethertype IPv6 ${name} >/dev/null 2>&1
+        fi
+    done
+    for cidr in ${private_network_cidr} ${public_network_cidrs}; do
+        if [ "$(openstack security group show ${name} -f shell -c rules | grep -F \"icmp\" | grep -F \"remote_ip_prefix='${cidr}'\")" == "" ]; then
+            openstack security group rule create --ingress --protocol icmp --remote-ip ${cidr} ${name} >/dev/null 2>&1
+        fi
+    done
+    for port in 22; do
+        for cidr in ${private_network_cidr} ${public_network_cidrs}; do
+            if [ "$(openstack security group show ${name} -f shell -c rules | grep -F \"port_range_min='${port}'\" | grep -F \"remote_ip_prefix='${cidr}'\")" == "" ]; then
+                openstack security group rule create --ingress --protocol tcp --dst-port ${port} --remote-ip ${cidr} ${name} >/dev/null 2>&1
+            fi
+        done
+    done
+done
+
+for name in dns; do
+    openstack security group show ${name} || openstack security group create --description "${name} ports" ${name} >/dev/null 2>&1
+    for port in 53; do
+        for cidr in ${private_network_cidr} ${public_network_cidrs}; do
+            if [ "$(openstack security group show ${name} -f shell -c rules | grep -F \"port_range_min='${port}'\" | grep -F \"remote_ip_prefix='${cidr}'\")" == "" ]; then
+                openstack security group rule create --ingress --protocol udp --dst-port ${port} --remote-ip ${cidr} ${name} >/dev/null 2>&1
+            fi
+        done
+    done
+done
+
+for name in vertx; do
+    openstack security group show ${name} || openstack security group create --description "${name} ports" ${name} >/dev/null 2>&1
+    for port in 5701:5710; do
+        for cidr in ${private_network_cidr}; do
+            if [ "$(openstack security group show ${name} -f shell -c rules | grep -F \"port_range_min='${port}'\" | grep -F \"remote_ip_prefix='${cidr}'\")" == "" ]; then
+                openstack security group rule create --ingress --protocol tcp --dst-port ${port} --remote-ip ${cidr} ${name} >/dev/null 2>&1
+            fi
+        done
+    done
+done
+
+for name in web; do
+    openstack security group show ${name} || openstack security group create --description "${name} ports" ${name} >/dev/null 2>&1
+    for port in 8080:8083; do
+        for cidr in ${private_network_cidr} ${public_network_cidrs}; do
+            if [ "$(openstack security group show ${name} -f shell -c rules | grep -F \"port_range_min='${port}'\" | grep -F \"remote_ip_prefix='${cidr}'\")" == "" ]; then
+                openstack security group rule create --ingress --protocol tcp --dst-port ${port} --remote-ip ${cidr} ${name} >/dev/null 2>&1
+            fi
+        done
+    done
+done
+
+for name in galera; do
+    openstack security group show ${name} || openstack security group create --description "${name} ports" ${name} >/dev/null 2>&1
+    for port in 3306 4444 4567 9200; do
+        for cidr in ${private_network_cidr} ${public_network_cidrs}; do
+            if [ "$(openstack security group show ${name} -f shell -c rules | grep -F \"port_range_min='${port}'\" | grep -F \"remote_ip_prefix='${cidr}'\")" == "" ]; then
+                openstack security group rule create --ingress --protocol tcp --dst-port ${port} --remote-ip ${cidr} ${name} >/dev/null 2>&1
+            fi
+        done
+    done
+done
+
+exit 0