mirror of
https://github.com/NetworkCats/rustyip.git
synced 2026-11-13 16:17:46 +00:00
NetworkCatsandClaude Opus 5.5
cd46024a46
The Vultr firewall now only opens 443 (and SSH); the host decides who may use it. Docker-published ports bypass UFW's INPUT rules, so the new firewall role routes Docker traffic through UFW's route rules via the DOCKER-USER chain and allows Cloudflare's IPv4 ranges on 443 with `ufw route allow`. ufw-cloudflare-sync keeps those rules in step with https://www.cloudflare.com/ips-v4 daily via a systemd timer, refusing to touch the rules if the list looks wrong. The role runs on every deploy, before HAProxy starts, and fails the deploy if the filtering is not in place, since HAProxy trusts CF-Connecting-IP from anything that reaches it. The plain UFW allows for 80/443 are dropped from the base role as they never applied to Docker-published ports. Rotating the deploy SSH key now rebuilds the instance, because Vultr only installs SSH keys at creation. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
22 lines
685 B
Terraform
22 lines
685 B
Terraform
resource "vultr_instance" "rustyip" {
|
|
plan = var.plan
|
|
region = var.region
|
|
os_id = var.os_id
|
|
label = var.instance_label
|
|
hostname = var.instance_label
|
|
enable_ipv6 = false
|
|
activation_email = false
|
|
backups = "disabled"
|
|
ddos_protection = false
|
|
firewall_group_id = vultr_firewall_group.rustyip.id
|
|
ssh_key_ids = [vultr_ssh_key.deploy.id]
|
|
|
|
tags = [var.instance_label]
|
|
|
|
# Vultr only installs SSH keys when an instance is created, so rotating the
|
|
# deploy key (SSH_PUBLIC_KEY) rebuilds the instance to take effect.
|
|
lifecycle {
|
|
replace_triggered_by = [vultr_ssh_key.deploy]
|
|
}
|
|
}
|