platform-admin/bootstrap-public
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Allow all private IPv4 traffic by default in Debian initialization firewall

Browse Source
This commit is contained in:
kaka
2026-11-04 22:46:18 +08:00
parent 56b506e54d
commit db1bd78bec
3 changed files with 22 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
host-init.sh
View File

@@ -27,15 +27,15 @@ check_existing_binding() {
[[ "$bound" == "$expected" ]] || { fail 'Existing bootstrap binding belongs to another hostname'; return 1; }
}
main() {
local action='' name='' packages='' public_key='' argument docker_mode=required
local action='' name='' packages='' public_key='' argument docker_mode=required firewall_policy='' firewall_script=''
while (($#)); do
case "$1" in
--help|-h) echo 'Usage: bash host-init.sh --check|--apply --hostname NAME [--docker-dir VERIFIED_DEB_DIRECTORY] [--ssh-key-file SHARED_PUBLIC_KEY] [--without-docker]'; return 0;;
--help|-h) echo 'Usage: bash host-init.sh --check|--apply --hostname NAME [--docker-dir VERIFIED_DEB_DIRECTORY] [--ssh-key-file SHARED_PUBLIC_KEY] [--without-docker] [--firewall-policy ROOT_0600_JSON --firewall-script VERIFIED_RELEASE_FIREWALL_SH]'; return 0;;
--without-docker) docker_mode=none; shift;;
--check|--apply) [[ -z "$action" ]] || return 1; action=$1; shift;;
--hostname|--docker-dir|--ssh-key-file)
--hostname|--docker-dir|--ssh-key-file|--firewall-policy|--firewall-script)
(($# >= 2)) || return 1
case "$1" in --hostname) name=$2;; --docker-dir) packages=$2;; --ssh-key-file) public_key=$2;; esac; shift 2;;
case "$1" in --hostname) name=$2;; --docker-dir) packages=$2;; --ssh-key-file) public_key=$2;; --firewall-policy) firewall_policy=$2;; --firewall-script) firewall_script=$2;; esac; shift 2;;
*) fail "Unknown argument: $1"; return 1;;
esac
done
@@ -71,6 +71,11 @@ main() {
ssh-keygen -l -f "$public_key" >/dev/null
[[ ! -L /root/.ssh && ! -L /root/.ssh/authorized_keys ]] || { fail 'Symlink in SSH destination'; return 1; }
fi
if [[ -n "$firewall_policy" || -n "$firewall_script" ]]; then
[[ "$firewall_policy" == /* && "$firewall_script" == /* && -f "$firewall_script" && ! -L "$firewall_script" && $(stat -c %u "$firewall_script") == 0 && $(stat -c %h "$firewall_script") == 1 ]] || { fail 'Use the verified root-owned release firewall script and explicit policy'; return 1; }
[[ -f "$firewall_policy" && ! -L "$firewall_policy" && $(stat -c %u "$firewall_policy") == 0 && $(stat -c %a "$firewall_policy") == 600 ]] || { fail 'Firewall policy must be a root-owned 0600 regular file'; return 1; }
bash "$firewall_script" --render --policy "$firewall_policy" >/dev/null
fi
[[ "$action" == --apply ]] || { echo 'Baseline inputs checked; no packages, hostname or SSH configuration changed.'; return 0; }
umask 077
exec 9>>/run/lock/platform-host-init.lock; flock -n 9 || { fail 'Host initialization is already running'; return 1; }
@@ -83,6 +88,13 @@ main() {
touch /root/.ssh/authorized_keys; chmod 0600 /root/.ssh/authorized_keys
if ! grep -Fqx -- "$(cat "$public_key")" /root/.ssh/authorized_keys; then printf '\n' >> /root/.ssh/authorized_keys; cat "$public_key" >> /root/.ssh/authorized_keys; fi
fi
if [[ -n "$firewall_policy" ]]; then
# Same native transaction as normal maintenance: all private sources allowed,
# public recovery inputs remain explicit; a fresh external SSH must confirm.
bash "$firewall_script" --check --policy "$firewall_policy"
bash "$firewall_script" --apply --policy "$firewall_policy"
echo 'Firewall pending: confirm its exact digest from a NEW SSH connection within 180 seconds.'
fi
if [[ "$docker_mode" == required ]]; then
systemctl enable --now docker
docker --host unix:///var/run/docker.sock info >/dev/null