gustavosantos/GTI_GERENCIADOR_FISCAL
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add 'fiscal/' from commit '102ba84500dbd9655a0471288c3e278652593ca9'

Browse Source 
git-subtree-dir: fiscal
git-subtree-mainline: d95165fc8f
git-subtree-split: 102ba84500
This commit is contained in:
gti
2026-09-29 14:43:23 -03:00
parent d95165fc8f 102ba84500
commit d21a9d1140
868 changed files with 566394 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fiscal/deploy/hub/restrict_hub_port.sh
+23
View File
@@ -0,0 +1,23 @@
#!/usr/bin/env sh
# Restrict the published Hub port so that only the reverse proxy host reaches it.
#
# HUB_BIND=10.0.10.117 HUB_PORT=8000 PROXY_IP=10.0.10.100 IFACE=ens18 sh restrict_hub_port.sh
#
# Docker-published ports never pass through UFW/INPUT: the packets are DNATed
# and forwarded, so the only supported place for this rule is DOCKER-USER.
# Matching on the conntrack *original* destination selects this published port
# (after DNAT the packet already points at the container); --ctdir ORIGINAL keeps
# the container's replies out of the DROP rule. Idempotent: safe to re-run.
# DOCKER-USER is not persisted across reboots — gti-fiscal-hub-port.service
# re-applies it every time docker.service starts.
set -eu
: "${HUB_BIND:?HUB_BIND is required}" "${PROXY_IP:?PROXY_IP is required}" "${IFACE:?IFACE is required}"
HUB_PORT="${HUB_PORT:-8000}"
MATCH="-i $IFACE -p tcp -m conntrack --ctdir ORIGINAL --ctorigdst $HUB_BIND --ctorigdstport $HUB_PORT"
iptables -N DOCKER-USER 2>/dev/null || true
while iptables -D DOCKER-USER $MATCH -s "$PROXY_IP" -j RETURN 2>/dev/null; do :; done
while iptables -D DOCKER-USER $MATCH -j DROP 2>/dev/null; do :; done
iptables -I DOCKER-USER 1 $MATCH -j DROP
iptables -I DOCKER-USER 1 $MATCH -s "$PROXY_IP" -j RETURN
iptables -S DOCKER-USER