From edbe446b34b5c33b32b26a5af8d5b82e9020d214 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9=20Padez?= Date: Fri, 14 Aug 2026 09:58:18 +0000 Subject: [PATCH] revert "allow port 22 through the docker-user allowlist" MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit this reverts e36c6bb4. the rule was added to fix gitea ssh on one box, but this file provisions every machine and most will never run gitea. opening 22 to containers by default is the wrong trade — the box that needs it can add the line deliberately. also restores the accuracy of the prompt in machine-setup.sh, which tells the operator the rules allow "only 80 and 443". Co-Authored-By: Claude Opus 5 --- scripts/setup/machine-setup/ufw-docker-rules.conf | 15 +-------------- 1 file changed, 1 insertion(+), 14 deletions(-) diff --git a/scripts/setup/machine-setup/ufw-docker-rules.conf b/scripts/setup/machine-setup/ufw-docker-rules.conf index 98f5fb44..a82ab97f 100644 --- a/scripts/setup/machine-setup/ufw-docker-rules.conf +++ b/scripts/setup/machine-setup/ufw-docker-rules.conf @@ -2,18 +2,8 @@ # Append these to /etc/ufw/after.rules (after the existing COMMIT) # Blocks all external access to Docker-published ports except: # - Trusted IPs (add your own) -# - Explicitly allowed public ports (80, 443, 22) +# - Explicitly allowed public ports (80, 443) # - Docker internal and loopback traffic -# -# This chain is the ONLY thing gating Docker-published ports from the internet: -# Docker writes its own DNAT/FORWARD rules and bypasses ufw entirely, so a -# `ufw allow ` has no effect on a published container port. If a container -# port must be reachable publicly, it needs a RETURN line below. -# -# Failure mode to recognise: the port appears open locally and `docker ps` shows -# it published, but external clients hang at TCP connect with no refusal. Local -# tests pass because they arrive via `lo` and match the loopback RETURN above, -# never reaching the DROP. Test from another machine, not from the host itself. *filter :DOCKER-USER - [0:0] @@ -33,9 +23,6 @@ # Allow public ports -A DOCKER-USER -i eth0 -p tcp --dport 80 -j RETURN -A DOCKER-USER -i eth0 -p tcp --dport 443 -j RETURN -# gitea SSH (NPM stream -> gitea:22). Host sshd does not use :22 publicly on a -# box that serves gitea — it moves to :2022 plus the tailnet IP, see ssh.socket. --A DOCKER-USER -i eth0 -p tcp --dport 22 -j RETURN # Drop everything else from external -A DOCKER-USER -i eth0 -j DROP