dongarandClaude Opus 5.5
eafe1b9f4a
deploy/agent-host sets up the vault on nisse-host (infra/tofu#77) and SilverBullet over it: the operator writes the vault, the agents' memory/ is read-only to it, and only the operator's Caddy reaches it, which serves vault.dongar.net to the LAN. scripts/agent-host.sh installs and checks it from here. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk
13 lines
692 B
Bash
Executable File
13 lines
692 B
Bash
Executable File
#!/bin/sh
|
|
# nisse-firewall ADDRESS PORT: only ADDRESS may reach a port Docker publishes
|
|
# as PORT. Docker publishes ports past the host's own firewall rules, so the
|
|
# limit goes in its DOCKER-USER chain. Installed by setup.sh and run by
|
|
# nisse-firewall.service whenever Docker starts. Its own rules (tagged) are
|
|
# replaced each run, so a changed address leaves no old rule behind.
|
|
set -eu
|
|
address=$1 port=$2
|
|
iptables -S DOCKER-USER | grep -- '--comment nisse-firewall' | sed 's/^-A /-D /' |
|
|
while read -r old; do eval "iptables $old"; done
|
|
iptables -I DOCKER-USER -p tcp -m conntrack --ctorigdstport "$port" \
|
|
--ctdir ORIGINAL ! -s "$address" -m comment --comment nisse-firewall -j DROP
|