config: update fw/nftables.conf.j2 to add the rule that allow connection from console to printer

ansible/inventory/group_vars/all.yaml

@@ -76,7 +76,7 @@ version:
     vaultwarden: "1.35.4"
     gitea: "1.25.5"
     redis: "8.6.1"
-    immich: "v2.6.2"
+    immich: "v2.6.3"
     actualbudget: "26.3.0"
     paperless: "2.20.13"
     vikunja: "2.2.2"

ansible/roles/app/tasks/services/set_vikunja.yaml

@@ -3,7 +3,7 @@
   ansible.builtin.set_fact:
     vikunja_subuid: "100999"
 
-- name: Create paperless directory
+- name: Create vikunja directory
   ansible.builtin.file:
     path: "{{ node['home_path'] }}/{{ item }}"
     state: "directory"

config/node/fw/nftables.conf.j2

@@ -30,6 +30,7 @@ define HOSTS4_INFRA = {{ hostvars['fw']['network4']['infra']['server'] }}
 define HOSTS4_AUTH = {{ hostvars['fw']['network4']['auth']['server'] }}
 define HOSTS4_APP = {{ hostvars['fw']['network4']['app']['server'] }}
 define HOSTS4_NAS = {{ hostvars['fw']['network4']['nas']['client'] }}
+define HOSTS4_PRINTER = {{ hostvars['fw']['network4']['printer']['client'] }}
 
 define HOSTS6_FW = { {{ hostvars['fw']['network6']['firewall'].values() | join(', ') }} }
 define HOSTS6_BLOCKY = {{ hostvars['fw']['network6']['blocky']['server'] }}
@@ -146,6 +147,8 @@ table inet filter {
                 # Kopia/NAS Console > NAS
                 oifname $IF_CLIENT ip saddr $HOSTS4_CONSOLE ip daddr $HOSTS4_NAS tcp dport { $PORTS_NAS, $PORTS_KOPIA } accept comment "allow ipv4 web connection (DSM, KOPIA): CONSOLE > FW > CLIENT NAS"
                 oifname $IF_CLIENT ip6 saddr $HOSTS6_CONSOLE ip6 daddr $HOSTS6_NAS tcp dport { $PORTS_NAS, $PORTS_KOPIA } accept comment "allow ipv6 web connection (DSM, KOPIA): CONSOLE > FW > CLIENT NAS"
+                # Printer
+                oifname $IF_CLIENT ip saddr $HOSTS4_CONSOLE ip daddr $HOSTS4_PRINTER accept comment "allow ipv4 printer connection: CONSOLE > FW > PRINTER"
 
                 iifname $IF_WAN jump wan comment "set WAN interface rules"
                 iifname $IF_CLIENT jump client comment "set CLIENT interface rules"

docs/specifications/environments.md

@@ -74,17 +74,16 @@
         - [x] Prometheus \(alloy - push\)
         - [x] Loki \(alloy\)
         - [x] Grafana 
-        <!-- 
+    <!-- 
         Mail service is not needed, especially Diun is not needed.
         - Postfix
         - Dovecot
         - mbsync
         - Diun
-        -->
     - Study \(Rootless container\):
         - Kali
         - Debian 
-
+    -->
 
 ## auth \(Authorization\)
 
@@ -115,30 +114,30 @@
     - Disk: SATA Controller
 - Services:
     - OIDC native services:
+        - [x] Vaultwarden
+        - [x] Gitea
+        - [x] Immich
+        - [x] Actual budget
+        - [x] Paperless-ngx
+        - [x] vikunja
         - OpenCloud \(with Radicale, Collabora Web Office\)
-        - Vikunja \(with CalDAV\)
-        - Gitea
         - Outline
         - Wiki.js
         - WriteFreely
-        - Immich
         - MediaCMS
         - Funkwhale
         - Kavita
         - Audiobookshelf
-        - we-promise/sure - budget
-        - Paperless-ngx
         - Miniflux
         - Linkwarden
         - Ralph
         - Conduit
         - SnappyMail
-        - Vaultwarden
-        <!--
+    <!--
         - n8n
-        -->
     - Forward_auth
         - Homepage
+    -->
 
 ## External Backup server