pastilhasandClaude Opus 5
edbe446b34
this reverts e36c6bb4. the rule was added to fix gitea ssh on one box, but this
file provisions every machine and most will never run gitea. opening 22 to
containers by default is the wrong trade — the box that needs it can add the
line deliberately.
also restores the accuracy of the prompt in machine-setup.sh, which tells the
operator the rules allow "only 80 and 443".
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
34 lines
905 B
Plaintext
34 lines
905 B
Plaintext
# UFW Docker compatibility rules
|
|
# Append these to /etc/ufw/after.rules (after the existing COMMIT)
|
|
# Blocks all external access to Docker-published ports except:
|
|
# - Trusted IPs (add your own)
|
|
# - Explicitly allowed public ports (80, 443)
|
|
# - Docker internal and loopback traffic
|
|
|
|
*filter
|
|
:DOCKER-USER - [0:0]
|
|
|
|
# Allow established/related
|
|
-A DOCKER-USER -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
|
|
|
|
# Allow loopback
|
|
-A DOCKER-USER -i lo -j RETURN
|
|
|
|
# Allow Docker internal networks
|
|
-A DOCKER-USER -s 172.16.0.0/12 -j RETURN
|
|
|
|
# Allow trusted external sources (add more lines as needed)
|
|
# -A DOCKER-USER -s <TRUSTED_IP> -j RETURN
|
|
|
|
# Allow public ports
|
|
-A DOCKER-USER -i eth0 -p tcp --dport 80 -j RETURN
|
|
-A DOCKER-USER -i eth0 -p tcp --dport 443 -j RETURN
|
|
|
|
# Drop everything else from external
|
|
-A DOCKER-USER -i eth0 -j DROP
|
|
|
|
# Return for non-external traffic
|
|
-A DOCKER-USER -j RETURN
|
|
|
|
COMMIT
|