gtiandClaude Opus 5.5
91a2dda969
GTI terminates TLS in its Nginx Proxy Manager (10.0.10.100), not on the Hub host, so the Hub must be reachable on the LAN — by the proxy only. - docker-compose.prod.yml passes FORWARDED_ALLOW_IPS (uvicorn then trusts X-Forwarded-For/-Proto from the proxy only: real client IPs in audit and session records, https scheme) and WEB_COOKIE_SECURE. Defaults keep the previous behaviour. - restrict_hub_port.sh + gti-fiscal-hub-port.service: Docker-published ports bypass UFW, so the source restriction lives in DOCKER-USER, matched on the conntrack original destination with --ctdir ORIGINAL, and is re-applied whenever docker.service starts (the chain is not persisted across reboots). - *.service forced to LF like *.sh; tests cover both. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
21 lines
811 B
Desktop File
21 lines
811 B
Desktop File
# Re-applies the Hub port restriction (restrict_hub_port.sh) whenever Docker starts.
|
|
# Install:
|
|
# sudo install -m 0755 restrict_hub_port.sh /usr/local/sbin/gti-fiscal-restrict-hub-port
|
|
# printf 'HUB_BIND=10.0.10.117\nHUB_PORT=8000\nPROXY_IP=10.0.10.100\nIFACE=ens18\n' | sudo tee /etc/default/gti-fiscal-hub-port
|
|
# sudo install -m 0644 gti-fiscal-hub-port.service /etc/systemd/system/
|
|
# sudo systemctl daemon-reload && sudo systemctl enable --now gti-fiscal-hub-port.service
|
|
[Unit]
|
|
Description=GTI Fiscal: allow the Hub port only from the reverse proxy
|
|
After=docker.service
|
|
Requires=docker.service
|
|
PartOf=docker.service
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
RemainAfterExit=yes
|
|
EnvironmentFile=/etc/default/gti-fiscal-hub-port
|
|
ExecStart=/usr/local/sbin/gti-fiscal-restrict-hub-port
|
|
|
|
[Install]
|
|
WantedBy=docker.service
|