gtiandClaude Opus 5.5
91a2dda969
GTI terminates TLS in its Nginx Proxy Manager (10.0.10.100), not on the Hub host, so the Hub must be reachable on the LAN — by the proxy only. - docker-compose.prod.yml passes FORWARDED_ALLOW_IPS (uvicorn then trusts X-Forwarded-For/-Proto from the proxy only: real client IPs in audit and session records, https scheme) and WEB_COOKIE_SECURE. Defaults keep the previous behaviour. - restrict_hub_port.sh + gti-fiscal-hub-port.service: Docker-published ports bypass UFW, so the source restriction lives in DOCKER-USER, matched on the conntrack original destination with --ctdir ORIGINAL, and is re-applied whenever docker.service starts (the chain is not persisted across reboots). - *.service forced to LF like *.sh; tests cover both. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
24 lines
1.3 KiB
Bash
24 lines
1.3 KiB
Bash
#!/usr/bin/env sh
|
|
# Restrict the published Hub port so that only the reverse proxy host reaches it.
|
|
#
|
|
# HUB_BIND=10.0.10.117 HUB_PORT=8000 PROXY_IP=10.0.10.100 IFACE=ens18 sh restrict_hub_port.sh
|
|
#
|
|
# Docker-published ports never pass through UFW/INPUT: the packets are DNATed
|
|
# and forwarded, so the only supported place for this rule is DOCKER-USER.
|
|
# Matching on the conntrack *original* destination selects this published port
|
|
# (after DNAT the packet already points at the container); --ctdir ORIGINAL keeps
|
|
# the container's replies out of the DROP rule. Idempotent: safe to re-run.
|
|
# DOCKER-USER is not persisted across reboots — gti-fiscal-hub-port.service
|
|
# re-applies it every time docker.service starts.
|
|
set -eu
|
|
: "${HUB_BIND:?HUB_BIND is required}" "${PROXY_IP:?PROXY_IP is required}" "${IFACE:?IFACE is required}"
|
|
HUB_PORT="${HUB_PORT:-8000}"
|
|
MATCH="-i $IFACE -p tcp -m conntrack --ctdir ORIGINAL --ctorigdst $HUB_BIND --ctorigdstport $HUB_PORT"
|
|
|
|
iptables -N DOCKER-USER 2>/dev/null || true
|
|
while iptables -D DOCKER-USER $MATCH -s "$PROXY_IP" -j RETURN 2>/dev/null; do :; done
|
|
while iptables -D DOCKER-USER $MATCH -j DROP 2>/dev/null; do :; done
|
|
iptables -I DOCKER-USER 1 $MATCH -j DROP
|
|
iptables -I DOCKER-USER 1 $MATCH -s "$PROXY_IP" -j RETURN
|
|
iptables -S DOCKER-USER
|