platform-admin/bootstrap-public
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Allow explicit trusted control IPv4 sources in initialization firewall

Browse Source
This commit is contained in:
kaka
2026-11-04 23:26:07 +08:00
parent e76cb4c1b6
commit 9eb8110c90
2 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
firewall.sh
View File

@@ -10,9 +10,10 @@ validate_policy() {
(split(".") | all(.[]; tonumber <= 255));
def tailip: ip and (split(".") | map(tonumber) | .[0] == 100 and .[1] >= 64 and .[1] <= 127);
def ports: type == "array" and all(.[]; type == "number" and . == floor and . >= 1 and . <= 65535);
(keys == ["hostname","management","public_tcp","public_udp","tailnet","version"]) and .version == 1 and
((keys - ["trusted_sources"]) == ["hostname","management","public_tcp","public_udp","tailnet","version"]) and .version == 1 and
(.hostname | type == "string" and length <= 63 and test("^(dev|test|stage|prod)-[a-z][a-z0-9]{0,15}-[a-z][a-z0-9]{0,15}(-[a-z][a-z0-9]{0,15})?-(0[1-9]|[1-9][0-9])$")) and
(.public_tcp | ports) and (.public_udp | ports) and
((.trusted_sources // []) | type == "array" and all(.[]; ip and (split(".")[0] | tonumber | . > 0 and . < 224))) and
(.management | keys == ["port","sources"]) and ([.management.port] | ports) and
(.management.sources | type == "array" and all(.[]; ip and (tailip | not))) and
(.tailnet | type == "array" and all(.[];
@@ -43,6 +44,11 @@ table inet platform_host {
udp sport 67 udp dport 68 accept
ip6 saddr fe80::/10 udp sport 547 udp dport 546 accept
NFT
# Public control hosts are explicit per-environment inputs, never compiled IPs.
sources=$(jq -r '(.trusted_sources // []) | unique | join(", ")' "$policy")
if [[ -n "$sources" ]]; then
printf ' ip saddr { %s } accept\n' "$sources"
fi
sources=$(jq -r '.management.sources | join(", ")' "$policy")
if [[ -n "$sources" ]]; then
printf ' iifname != "tailscale0" ip saddr { %s } tcp dport %s accept\n' "$sources" "$(jq -r .management.port "$policy")"