glass beadian
2cb77ae6b4
- archive_sync_state keyed by room per migration 029 (drop synthetic id cursor) - putStaging buffers the stream and sends content-length (oCIS rejects chunked) - mimeClass passthrough from sniffed payload - edge-firewall: RETURN docker-bridge ingress before the CF-range catch-all so container egress (Matrix/R2/platform) survives the 80/443 source filter - files scaffold: keep the ocdav data-gateway hop on-loopback
48 lines
1.8 KiB
Bash
Executable file
48 lines
1.8 KiB
Bash
Executable file
#!/bin/bash
|
|
# edge-firewall.sh — restrict the edge ports to Cloudflare's ranges only.
|
|
# Mode file ./firewall.mode: "CF" (default, CF ranges only) or "OPEN" (anyone —
|
|
# grey mode: visitors connect directly, nginx rejects unknown SNI).
|
|
# Idempotent; safe to re-run (rebuilds the DOCKER-USER rules from scratch).
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")"
|
|
|
|
MODE="CF"
|
|
[[ -f firewall.mode ]] && MODE=$(cat firewall.mode)
|
|
CF4_URL="https://www.cloudflare.com/ips-v4"
|
|
CF6_URL="https://www.cloudflare.com/ips-v6"
|
|
|
|
# Reset our rules, keep anything else in DOCKER-USER.
|
|
iptables -F DOCKER-USER
|
|
ip6tables -F DOCKER-USER 2>/dev/null || true
|
|
|
|
# DOCKER-USER sees forwarded traffic in BOTH directions. Exempt everything
|
|
# originating from a docker bridge (container egress) BEFORE any port rules —
|
|
# otherwise the CF-range catch-all below also drops containers' outbound 443
|
|
# (Matrix/R2/platform calls). Inbound filtering by source is unaffected.
|
|
for br in $(ls /sys/class/net/ | grep -E '^(br-|docker0)'); do
|
|
iptables -I DOCKER-USER 1 -i "$br" -j RETURN
|
|
done
|
|
|
|
if [[ $MODE == OPEN ]]; then
|
|
echo "edge firewall: OPEN (any source allowed on 80/443; nginx SNI gate applies)"
|
|
exit 0
|
|
fi
|
|
|
|
mapfile -t CF4 < <(curl -s -m 15 "$CF4_URL" | grep -v '^$')
|
|
mapfile -t CF6 < <(curl -s -m 15 "$CF6_URL" | grep -v '^$')
|
|
|
|
((${#CF4[@]} > 5)) || { echo "cf ips-v4 fetch failed" >&2; exit 1; }
|
|
|
|
for net in "${CF4[@]}"; do
|
|
iptables -A DOCKER-USER -p tcp -m multiport --dports 80,443 -s "$net" -j RETURN
|
|
done
|
|
iptables -A DOCKER-USER -p tcp -m multiport --dports 80,443 -j DROP
|
|
|
|
if ((${#CF6[@]} > 0)); then
|
|
for net in "${CF6[@]}"; do
|
|
ip6tables -A DOCKER-USER -p tcp -m multiport --dports 80,443 -s "$net" -j RETURN 2>/dev/null || true
|
|
done
|
|
ip6tables -A DOCKER-USER -p tcp -m multiport --dports 80,443 -j DROP 2>/dev/null || true
|
|
fi
|
|
|
|
echo "edge firewall: ${#CF4[@]} v4 + ${#CF6[@]} v6 CF ranges allowed on 80/443"
|