hacklab/T-HUB
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Edge: tailscale0 relay exemption, CT320 transit hop, files/office/intake host parity

Browse source
This commit is contained in:
glass beadian 2026-10-11 21:36:20 +00:00
parent 83e34aa343
commit 7cea73dc0d
2 changed files with 86 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

19
infra/occupymedia/edge/edge-firewall.sh
View file

@ -23,6 +23,25 @@ for br in $(ls /sys/class/net/ | grep -E '^(br-|docker0)'); do
iptables -I DOCKER-USER 1 -i "$br" -j RETURN
done
# The ipfs3 ingress relay arrives over tailscale0 and terminates on the edge
# nginx; exempt it from the CF-ranges-only filter (trusted tailnet source).
iptables -C DOCKER-USER -i tailscale0 -j RETURN 2>/dev/null || \
iptables -I DOCKER-USER 1 -i tailscale0 -j RETURN
# Transit hop for occ-files (CT 320): CF-bound traffic from it rides this CT so
# the exit-node failover below covers oCIS blob writes too. Forward + NAT only;
# occ-files adds the CF-range routes toward this CT's LAN IP.
if [ "$(hostname -I 2>/dev/null | awk '{print $1}')" = "192.168.13.221" ]; then
iptables -C FORWARD -s 192.168.13.210 -d 192.168.13.0/24 -j ACCEPT 2>/dev/null || \
iptables -I FORWARD 1 -s 192.168.13.210 -d 192.168.13.0/24 -j ACCEPT
iptables -C FORWARD -s 192.168.13.210 -j ACCEPT 2>/dev/null || \
iptables -I FORWARD 1 -s 192.168.13.210 -j ACCEPT
iptables -t nat -C POSTROUTING -s 192.168.13.210 -d 192.168.13.0/24 -j RETURN 2>/dev/null || \
iptables -t nat -A POSTROUTING -s 192.168.13.210 -d 192.168.13.0/24 -j RETURN
iptables -t nat -C POSTROUTING -s 192.168.13.210 -j MASQUERADE 2>/dev/null || \
iptables -t nat -A POSTROUTING -s 192.168.13.210 -j MASQUERADE
fi
if [[ $MODE == OPEN ]]; then
echo "edge firewall: OPEN (any source allowed on 80/443; nginx SNI gate applies)"
exit 0