mirror of
https://github.com/NetworkCats/rustyip.git
synced 2026-11-13 16:17:46 +00:00
NetworkCatsandClaude Opus 5.5
cd46024a46
The Vultr firewall now only opens 443 (and SSH); the host decides who may use it. Docker-published ports bypass UFW's INPUT rules, so the new firewall role routes Docker traffic through UFW's route rules via the DOCKER-USER chain and allows Cloudflare's IPv4 ranges on 443 with `ufw route allow`. ufw-cloudflare-sync keeps those rules in step with https://www.cloudflare.com/ips-v4 daily via a systemd timer, refusing to touch the rules if the list looks wrong. The role runs on every deploy, before HAProxy starts, and fails the deploy if the filtering is not in place, since HAProxy trusts CF-Connecting-IP from anything that reaches it. The plain UFW allows for 80/443 are dropped from the base role as they never applied to Docker-published ports. Rotating the deploy SSH key now rebuilds the instance, because Vultr only installs SSH keys at creation. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
27 lines
870 B
Terraform
27 lines
870 B
Terraform
resource "vultr_firewall_group" "rustyip" {
|
|
description = "${var.instance_label} firewall"
|
|
}
|
|
|
|
# Allow SSH from anywhere (IPv4)
|
|
resource "vultr_firewall_rule" "ssh_v4" {
|
|
firewall_group_id = vultr_firewall_group.rustyip.id
|
|
protocol = "tcp"
|
|
ip_type = "v4"
|
|
subnet = "0.0.0.0"
|
|
subnet_size = 0
|
|
port = "22"
|
|
notes = "Allow SSH from anywhere"
|
|
}
|
|
|
|
# Allow HTTPS from anywhere (IPv4). The host restricts it to Cloudflare's
|
|
# ranges with UFW (ansible firewall role), which keeps the list current.
|
|
resource "vultr_firewall_rule" "https_v4" {
|
|
firewall_group_id = vultr_firewall_group.rustyip.id
|
|
protocol = "tcp"
|
|
ip_type = "v4"
|
|
subnet = "0.0.0.0"
|
|
subnet_size = 0
|
|
port = "443"
|
|
notes = "Allow HTTPS; host UFW limits it to Cloudflare"
|
|
}
|