hacklab/T-HUB
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Edge: tailscale0 relay exemption, CT320 transit hop, files/office/intake host parity

Browse source
This commit is contained in:
glass beadian 2026-10-11 21:36:20 +00:00
parent 83e34aa343
commit 7cea73dc0d
2 changed files with 86 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

19
infra/occupymedia/edge/edge-firewall.sh
View file

@ -23,6 +23,25 @@ for br in $(ls /sys/class/net/ | grep -E '^(br-|docker0)'); do
iptables -I DOCKER-USER 1 -i "$br" -j RETURN
done
# The ipfs3 ingress relay arrives over tailscale0 and terminates on the edge
# nginx; exempt it from the CF-ranges-only filter (trusted tailnet source).
iptables -C DOCKER-USER -i tailscale0 -j RETURN 2>/dev/null || \
iptables -I DOCKER-USER 1 -i tailscale0 -j RETURN
# Transit hop for occ-files (CT 320): CF-bound traffic from it rides this CT so
# the exit-node failover below covers oCIS blob writes too. Forward + NAT only;
# occ-files adds the CF-range routes toward this CT's LAN IP.
if [ "$(hostname -I 2>/dev/null | awk '{print $1}')" = "192.168.13.221" ]; then
iptables -C FORWARD -s 192.168.13.210 -d 192.168.13.0/24 -j ACCEPT 2>/dev/null || \
iptables -I FORWARD 1 -s 192.168.13.210 -d 192.168.13.0/24 -j ACCEPT
iptables -C FORWARD -s 192.168.13.210 -j ACCEPT 2>/dev/null || \
iptables -I FORWARD 1 -s 192.168.13.210 -j ACCEPT
iptables -t nat -C POSTROUTING -s 192.168.13.210 -d 192.168.13.0/24 -j RETURN 2>/dev/null || \
iptables -t nat -A POSTROUTING -s 192.168.13.210 -d 192.168.13.0/24 -j RETURN
iptables -t nat -C POSTROUTING -s 192.168.13.210 -j MASQUERADE 2>/dev/null || \
iptables -t nat -A POSTROUTING -s 192.168.13.210 -j MASQUERADE
fi
if [[ $MODE == OPEN ]]; then
echo "edge firewall: OPEN (any source allowed on 80/443; nginx SNI gate applies)"
exit 0

67
infra/occupymedia/edge/nginx.conf
View file

@ -16,6 +16,9 @@ http {
"" close;
}
# Lets the remote failover probe tell edge-served responses from tunnel-served.
add_header X-Served-By occ-edge always;
# HTTP: redirect everything to HTTPS.
server {
listen 80;
@ -125,6 +128,70 @@ http {
return 200 "edge-ok";
}
# Parity with the tunnel ingress: occ-files + Collabora live on CT 320.
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name files.occupymedia.cc;
ssl_certificate /etc/letsencrypt/live/occupymedia.cc/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/occupymedia.cc/privkey.pem;
client_max_body_size 512m;
location / {
proxy_pass http://192.168.13.210:9200;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_read_timeout 3600s;
proxy_send_timeout 3600s;
proxy_buffering off;
}
}
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name office.occupymedia.cc;
ssl_certificate /etc/letsencrypt/live/occupymedia.cc/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/occupymedia.cc/privkey.pem;
location / {
proxy_pass http://192.168.13.210:9980;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_read_timeout 3600s;
proxy_send_timeout 3600s;
}
}
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name intake.occupymedia.cc;
ssl_certificate /etc/letsencrypt/live/occupymedia.cc/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/occupymedia.cc/privkey.pem;
client_max_body_size 20m;
location / {
proxy_pass http://occ-intake:3000;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_read_timeout 60s;
}
}
# Everything else on this IP: drop the connection.
server {
listen 443 ssl default_server;