53e2eb7c84
All checks were successful
Sync infra to hosts / sync-beta (push) Has been skipped
Sync infra to hosts / sync-prod (push) Has been skipped
Sync infra to hosts / sync-centralis (push) Has been skipped
Sync infra to hosts / sync-dev (push) Successful in 9s
secrets-guard / encrypted (push) Successful in 5s
Validate observability stack / validate (push) Successful in 12s
shell-lint / shellcheck (push) Successful in 8s
Build + push images (Forgejo registry) / build-push (frontend) (push) Successful in 26s
Build + push images (Forgejo registry) / build-push (backend) (push) Successful in 1m10s
Deploy / deploy (backend) (push) Successful in 1m41s
Deploy / deploy (frontend) (push) Successful in 1m48s
secrets-guard / encrypted (pull_request) Successful in 8s
shell-lint / shellcheck (pull_request) Successful in 9s
PR build (required check) / changes (pull_request) Successful in 20s
PR build (required check) / validate-observability (pull_request) Successful in 15s
PR build (required check) / build-frontend (pull_request) Successful in 17s
PR build (required check) / build-backend (pull_request) Successful in 2m26s
PR build (required check) / gate (pull_request) Successful in 1s
Completes the Forgejo domain migration. ROOT_URL moved to dev.jinemi.com earlier; the registry half was deliberately deferred. Every image name, REGISTRY_HOST default, runner label and --add-host pin now names dev.jinemi.com, so the registry host and the bearer-token realm agree again. Both names address the same Forgejo, so no image needs re-pushing and a rollback to a tag pushed under the old prefix still resolves. git.thermograph.org therefore stays served off the same Caddy site block -- one block, so the /v2/* mesh-only matcher keeps covering both names -- for pre-migration tags and for runners holding it as their registered instance URL. Mesh clients now pin both names in /etc/hosts: the new one as registry host and token realm, the old one for pre-migration tags. runner-vps2/config.yaml carries both --add-host entries for the same reason. Also renames Centralis' endpoint to mcp.jinemi.com in the two places this repo names it; Centralis itself is provisioned outside this repo. Host-side steps this cannot do (documented in deploy/forgejo/README.md, "Host-side steps"): the Forgejo Actions variable REGISTRY_HOST, docker login against the new host, and the /etc/hosts pins.
43 lines
1.9 KiB
Bash
Executable file
43 lines
1.9 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Locks the Swarm ports (2377 control, 7946 gossip, 4789 overlay VXLAN) to the
|
|
# WireGuard interface only — they must never be reachable from the public
|
|
# internet. Run on ALL THREE nodes (vps2, vps1, desktop) after joining the
|
|
# swarm. Existing app-facing rules (80/443, SSH, etc.) are untouched.
|
|
set -euo pipefail
|
|
|
|
WG_IFACE="${WG_IFACE:-wg0}"
|
|
|
|
if ! command -v ufw >/dev/null 2>&1; then
|
|
echo "ufw not found — apply the equivalent iptables/nftables rules by hand:" >&2
|
|
echo " allow 2377/tcp, 7946/tcp, 7946/udp, 4789/udp only on interface ${WG_IFACE}" >&2
|
|
echo " deny 2377/tcp, 7946/tcp, 7946/udp, 4789/udp on every other interface" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "==> Allowing Swarm ports on ${WG_IFACE} only"
|
|
ufw allow in on "$WG_IFACE" to any port 2377 proto tcp
|
|
ufw allow in on "$WG_IFACE" to any port 7946 proto tcp
|
|
ufw allow in on "$WG_IFACE" to any port 7946 proto udp
|
|
ufw allow in on "$WG_IFACE" to any port 4789 proto udp
|
|
|
|
echo "==> Explicitly denying the same ports on every other interface"
|
|
ufw deny 2377/tcp
|
|
ufw deny 7946/tcp
|
|
ufw deny 7946/udp
|
|
ufw deny 4789/udp
|
|
|
|
echo
|
|
echo "Rules added (not yet necessarily active — check ufw status):"
|
|
ufw status numbered | grep -E "2377|7946|4789|Status" || true
|
|
echo
|
|
if ! ufw status | grep -q "^Status: active"; then
|
|
echo "ufw is currently INACTIVE on this node — 'ufw enable' switches its"
|
|
echo "default policy to deny-incoming for EVERYTHING, not just the Swarm"
|
|
echo "ports above. Before enabling, explicitly allow every port this node"
|
|
echo "already serves publicly (SSH at minimum; on vps2 specifically, also"
|
|
echo "80/tcp and 443/tcp for the live thermograph.org/beta.thermograph.org"
|
|
echo "Caddy; on vps1, 80/tcp and 443/tcp for dev.jinemi.com,"
|
|
echo "dashboard.thermograph.org and emigriffith.dev) — check 'ss -tlnp' for"
|
|
echo "what's actually listening first. Enabling ufw without doing this WILL"
|
|
echo "drop live traffic the moment it activates."
|
|
fi
|