Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Gitea Actions Bot
|
e3b6559e9e | ||
 Ultradesu
|
719504a399 |
@@ -42,7 +42,9 @@ ArgoCD homelab project
|
||||
|
||||
| Application | Status |
|
||||
| :--- | :---: |
|
||||
| **amnezia** | [](https://ag.hexor.cy/applications/argocd/amnezia) |
|
||||
| **comfyui** | [](https://ag.hexor.cy/applications/argocd/comfyui) |
|
||||
| **doka2-lobby-list** | [](https://ag.hexor.cy/applications/argocd/doka2-lobby-list) |
|
||||
| **furumi** | [](https://ag.hexor.cy/applications/argocd/furumi) |
|
||||
| **gitea** | [](https://ag.hexor.cy/applications/argocd/gitea) |
|
||||
| **greece-notifier** | [](https://ag.hexor.cy/applications/argocd/greece-notifier) |
|
||||
@@ -53,6 +55,7 @@ ArgoCD homelab project
|
||||
| **k8s-secrets** | [](https://ag.hexor.cy/applications/argocd/k8s-secrets) |
|
||||
| **khm** | [](https://ag.hexor.cy/applications/argocd/khm) |
|
||||
| **lidarr** | [](https://ag.hexor.cy/applications/argocd/lidarr) |
|
||||
| **llamacpp** | [](https://ag.hexor.cy/applications/argocd/llamacpp) |
|
||||
| **matrix** | [](https://ag.hexor.cy/applications/argocd/matrix) |
|
||||
| **mtproxy** | [](https://ag.hexor.cy/applications/argocd/mtproxy) |
|
||||
| **n8n** | [](https://ag.hexor.cy/applications/argocd/n8n) |
|
||||
|
||||
@@ -10,7 +10,6 @@ data:
|
||||
|
||||
PORT="${1:-5847}"
|
||||
VPN_CIDR="${2:-10.8.0.0/16}"
|
||||
INPUT_CHAIN="AMNEZIAWG-INPUT"
|
||||
FORWARD_CHAIN="AMNEZIAWG-FORWARD"
|
||||
IPTABLES=(iptables -w 30)
|
||||
|
||||
@@ -76,13 +75,9 @@ data:
|
||||
delete_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
|
||||
delete_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
|
||||
delete_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
|
||||
|
||||
reset_chain "${INPUT_CHAIN}"
|
||||
"${IPTABLES[@]}" -A "${INPUT_CHAIN}" -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
|
||||
"${IPTABLES[@]}" -A "${INPUT_CHAIN}" -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
|
||||
"${IPTABLES[@]}" -A "${INPUT_CHAIN}" -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
|
||||
"${IPTABLES[@]}" -A "${INPUT_CHAIN}" -j RETURN
|
||||
ensure_rule -I INPUT -m comment --comment amneziawg-input-jump -j "${INPUT_CHAIN}"
|
||||
delete_rule INPUT -m comment --comment amneziawg-input-jump -j AMNEZIAWG-INPUT
|
||||
"${IPTABLES[@]}" -F AMNEZIAWG-INPUT >/dev/null 2>&1 || true
|
||||
"${IPTABLES[@]}" -X AMNEZIAWG-INPUT >/dev/null 2>&1 || true
|
||||
|
||||
reset_chain "${FORWARD_CHAIN}"
|
||||
"${IPTABLES[@]}" -A "${FORWARD_CHAIN}" -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
|
||||
@@ -100,7 +95,6 @@ data:
|
||||
|
||||
PORT="${1:-5847}"
|
||||
VPN_CIDR="${2:-10.8.0.0/16}"
|
||||
INPUT_CHAIN="AMNEZIAWG-INPUT"
|
||||
FORWARD_CHAIN="AMNEZIAWG-FORWARD"
|
||||
IPTABLES=(iptables -w 30)
|
||||
|
||||
@@ -139,11 +133,11 @@ data:
|
||||
delete_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
|
||||
delete_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
|
||||
delete_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
|
||||
delete_rule INPUT -m comment --comment amneziawg-input-jump -j "${INPUT_CHAIN}"
|
||||
delete_rule INPUT -m comment --comment amneziawg-input-jump -j AMNEZIAWG-INPUT
|
||||
delete_rule FORWARD -m comment --comment amneziawg-forward-jump -j "${FORWARD_CHAIN}"
|
||||
|
||||
"${IPTABLES[@]}" -F "${INPUT_CHAIN}" >/dev/null 2>&1 || true
|
||||
"${IPTABLES[@]}" -X "${INPUT_CHAIN}" >/dev/null 2>&1 || true
|
||||
"${IPTABLES[@]}" -F AMNEZIAWG-INPUT >/dev/null 2>&1 || true
|
||||
"${IPTABLES[@]}" -X AMNEZIAWG-INPUT >/dev/null 2>&1 || true
|
||||
"${IPTABLES[@]}" -F "${FORWARD_CHAIN}" >/dev/null 2>&1 || true
|
||||
"${IPTABLES[@]}" -X "${FORWARD_CHAIN}" >/dev/null 2>&1 || true
|
||||
|
||||
@@ -153,7 +147,6 @@ data:
|
||||
|
||||
PORT="${1:-5847}"
|
||||
VPN_CIDR="${2:-10.8.0.0/16}"
|
||||
INPUT_CHAIN="AMNEZIAWG-INPUT"
|
||||
FORWARD_CHAIN="AMNEZIAWG-FORWARD"
|
||||
IPTABLES=(iptables -w 5)
|
||||
|
||||
@@ -178,11 +171,10 @@ data:
|
||||
echo "Unsafe broad UDP ACCEPT on ${EXT_IF} is present" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
"${IPTABLES[@]}" -C INPUT -m comment --comment amneziawg-input-jump -j "${INPUT_CHAIN}"
|
||||
"${IPTABLES[@]}" -C "${INPUT_CHAIN}" -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
|
||||
"${IPTABLES[@]}" -C "${INPUT_CHAIN}" -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
|
||||
"${IPTABLES[@]}" -C "${INPUT_CHAIN}" -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
|
||||
if "${IPTABLES[@]}" -C INPUT -m comment --comment amneziawg-input-jump -j AMNEZIAWG-INPUT >/dev/null 2>&1; then
|
||||
echo "Unexpected AmneziaWG INPUT chain is present" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
"${IPTABLES[@]}" -C FORWARD -m comment --comment amneziawg-forward-jump -j "${FORWARD_CHAIN}"
|
||||
"${IPTABLES[@]}" -C "${FORWARD_CHAIN}" -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
|
||||
|
||||
@@ -128,15 +128,24 @@ spec:
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 8
|
||||
failureThreshold: 2
|
||||
startupProbe:
|
||||
exec:
|
||||
command:
|
||||
- /bin/bash
|
||||
- -lc
|
||||
- /scripts/firewall-check.sh 5847 10.8.0.0/16 || /scripts/firewall-up.sh 5847 10.8.0.0/16
|
||||
periodSeconds: 5
|
||||
timeoutSeconds: 15
|
||||
failureThreshold: 12
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
- /bin/bash
|
||||
- -lc
|
||||
- /scripts/firewall-check.sh 5847 10.8.0.0/16
|
||||
- /scripts/firewall-check.sh 5847 10.8.0.0/16 || /scripts/firewall-up.sh 5847 10.8.0.0/16
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 8
|
||||
timeoutSeconds: 15
|
||||
failureThreshold: 3
|
||||
resources:
|
||||
requests:
|
||||
|
||||
Reference in New Issue
Block a user