Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Gitea Actions Bot
|
33d6045a66 |
@@ -10,17 +10,12 @@ data:
|
||||
|
||||
PORT="${1:-5847}"
|
||||
VPN_CIDR="${2:-10.8.0.0/16}"
|
||||
INPUT_CHAIN="AMNEZIAWG-INPUT"
|
||||
FORWARD_CHAIN="AMNEZIAWG-FORWARD"
|
||||
IPTABLES=(iptables -w 30)
|
||||
|
||||
external_interface() {
|
||||
ip route get 1.1.1.1 | awk '{for (i=1;i<=NF;i++) if ($i=="dev") {print $(i+1); exit}}'
|
||||
}
|
||||
|
||||
ensure_rule() {
|
||||
local mode="$1"
|
||||
shift
|
||||
ensure_insert_rule() {
|
||||
local table_args=()
|
||||
if [ "${1:-}" = "-t" ]; then
|
||||
table_args=("$1" "$2")
|
||||
@@ -30,8 +25,8 @@ data:
|
||||
local chain="$1"
|
||||
shift
|
||||
|
||||
if ! "${IPTABLES[@]}" "${table_args[@]}" -C "${chain}" "$@" >/dev/null 2>&1; then
|
||||
"${IPTABLES[@]}" "${table_args[@]}" "${mode}" "${chain}" "$@"
|
||||
if ! iptables "${table_args[@]}" -C "${chain}" "$@" >/dev/null 2>&1; then
|
||||
iptables "${table_args[@]}" -I "${chain}" 1 "$@"
|
||||
fi
|
||||
}
|
||||
|
||||
@@ -45,15 +40,24 @@ data:
|
||||
local chain="$1"
|
||||
shift
|
||||
|
||||
while "${IPTABLES[@]}" "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
|
||||
while iptables "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
|
||||
true
|
||||
done
|
||||
}
|
||||
|
||||
reset_chain() {
|
||||
ensure_append_rule() {
|
||||
local table_args=()
|
||||
if [ "${1:-}" = "-t" ]; then
|
||||
table_args=("$1" "$2")
|
||||
shift 2
|
||||
fi
|
||||
|
||||
local chain="$1"
|
||||
"${IPTABLES[@]}" -N "${chain}" >/dev/null 2>&1 || true
|
||||
"${IPTABLES[@]}" -F "${chain}"
|
||||
shift
|
||||
|
||||
if ! iptables "${table_args[@]}" -C "${chain}" "$@" >/dev/null 2>&1; then
|
||||
iptables "${table_args[@]}" -A "${chain}" "$@"
|
||||
fi
|
||||
}
|
||||
|
||||
EXT_IF="$(external_interface || true)"
|
||||
@@ -67,32 +71,13 @@ data:
|
||||
|
||||
sysctl -w net.ipv4.ip_forward=1
|
||||
|
||||
# Remove rules written by older revisions. In particular, the unqualified
|
||||
# tailscale UDP DROP also blocks Flannel VXLAN (UDP/8472).
|
||||
delete_rule INPUT -i tailscale0 -p udp -m comment --comment amneziawg-block-tailscale -j DROP
|
||||
delete_rule INPUT -i "${EXT_IF}" -p udp -m comment --comment amneziawg-allow-external -j ACCEPT
|
||||
delete_rule INPUT -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
|
||||
delete_rule INPUT -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
|
||||
delete_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
|
||||
delete_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
|
||||
delete_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
|
||||
|
||||
reset_chain "${INPUT_CHAIN}"
|
||||
"${IPTABLES[@]}" -A "${INPUT_CHAIN}" -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
|
||||
"${IPTABLES[@]}" -A "${INPUT_CHAIN}" -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
|
||||
"${IPTABLES[@]}" -A "${INPUT_CHAIN}" -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
|
||||
"${IPTABLES[@]}" -A "${INPUT_CHAIN}" -j RETURN
|
||||
ensure_rule -I INPUT -m comment --comment amneziawg-input-jump -j "${INPUT_CHAIN}"
|
||||
|
||||
reset_chain "${FORWARD_CHAIN}"
|
||||
"${IPTABLES[@]}" -A "${FORWARD_CHAIN}" -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
|
||||
"${IPTABLES[@]}" -A "${FORWARD_CHAIN}" -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
|
||||
"${IPTABLES[@]}" -A "${FORWARD_CHAIN}" -j RETURN
|
||||
ensure_rule -A FORWARD -m comment --comment amneziawg-forward-jump -j "${FORWARD_CHAIN}"
|
||||
|
||||
ensure_rule -A -t nat POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
|
||||
|
||||
/scripts/firewall-check.sh "${PORT}" "${VPN_CIDR}"
|
||||
ensure_insert_rule INPUT -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
|
||||
ensure_insert_rule INPUT -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
|
||||
ensure_append_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
|
||||
ensure_append_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
|
||||
ensure_append_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
|
||||
ensure_append_rule -t nat POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
|
||||
|
||||
firewall-down.sh: |
|
||||
#!/usr/bin/env bash
|
||||
@@ -100,9 +85,6 @@ data:
|
||||
|
||||
PORT="${1:-5847}"
|
||||
VPN_CIDR="${2:-10.8.0.0/16}"
|
||||
INPUT_CHAIN="AMNEZIAWG-INPUT"
|
||||
FORWARD_CHAIN="AMNEZIAWG-FORWARD"
|
||||
IPTABLES=(iptables -w 30)
|
||||
|
||||
external_interface() {
|
||||
ip route get 1.1.1.1 | awk '{for (i=1;i<=NF;i++) if ($i=="dev") {print $(i+1); exit}}'
|
||||
@@ -118,7 +100,7 @@ data:
|
||||
local chain="$1"
|
||||
shift
|
||||
|
||||
while "${IPTABLES[@]}" "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
|
||||
while iptables "${table_args[@]}" -D "${chain}" "$@" >/dev/null 2>&1; do
|
||||
true
|
||||
done
|
||||
}
|
||||
@@ -129,7 +111,6 @@ data:
|
||||
fi
|
||||
|
||||
if [ -n "${EXT_IF}" ]; then
|
||||
delete_rule INPUT -i "${EXT_IF}" -p udp -m comment --comment amneziawg-allow-external -j ACCEPT
|
||||
delete_rule INPUT -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
|
||||
delete_rule -t nat POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
|
||||
fi
|
||||
@@ -139,57 +120,6 @@ data:
|
||||
delete_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
|
||||
delete_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
|
||||
delete_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
|
||||
delete_rule INPUT -m comment --comment amneziawg-input-jump -j "${INPUT_CHAIN}"
|
||||
delete_rule FORWARD -m comment --comment amneziawg-forward-jump -j "${FORWARD_CHAIN}"
|
||||
|
||||
"${IPTABLES[@]}" -F "${INPUT_CHAIN}" >/dev/null 2>&1 || true
|
||||
"${IPTABLES[@]}" -X "${INPUT_CHAIN}" >/dev/null 2>&1 || true
|
||||
"${IPTABLES[@]}" -F "${FORWARD_CHAIN}" >/dev/null 2>&1 || true
|
||||
"${IPTABLES[@]}" -X "${FORWARD_CHAIN}" >/dev/null 2>&1 || true
|
||||
|
||||
firewall-check.sh: |
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
PORT="${1:-5847}"
|
||||
VPN_CIDR="${2:-10.8.0.0/16}"
|
||||
INPUT_CHAIN="AMNEZIAWG-INPUT"
|
||||
FORWARD_CHAIN="AMNEZIAWG-FORWARD"
|
||||
IPTABLES=(iptables -w 5)
|
||||
|
||||
external_interface() {
|
||||
ip route get 1.1.1.1 | awk '{for (i=1;i<=NF;i++) if ($i=="dev") {print $(i+1); exit}}'
|
||||
}
|
||||
|
||||
EXT_IF="$(external_interface || true)"
|
||||
if [ -z "${EXT_IF}" ]; then
|
||||
EXT_IF="$(ip route show default | awk '{print $5; exit}')"
|
||||
fi
|
||||
if [ -z "${EXT_IF}" ]; then
|
||||
echo "Unable to detect external interface" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if "${IPTABLES[@]}" -C INPUT -i tailscale0 -p udp -m comment --comment amneziawg-block-tailscale -j DROP >/dev/null 2>&1; then
|
||||
echo "Unsafe broad UDP DROP on tailscale0 is present" >&2
|
||||
exit 1
|
||||
fi
|
||||
if "${IPTABLES[@]}" -C INPUT -i "${EXT_IF}" -p udp -m comment --comment amneziawg-allow-external -j ACCEPT >/dev/null 2>&1; then
|
||||
echo "Unsafe broad UDP ACCEPT on ${EXT_IF} is present" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
"${IPTABLES[@]}" -C INPUT -m comment --comment amneziawg-input-jump -j "${INPUT_CHAIN}"
|
||||
"${IPTABLES[@]}" -C "${INPUT_CHAIN}" -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
|
||||
"${IPTABLES[@]}" -C "${INPUT_CHAIN}" -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
|
||||
"${IPTABLES[@]}" -C "${INPUT_CHAIN}" -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
|
||||
|
||||
"${IPTABLES[@]}" -C FORWARD -m comment --comment amneziawg-forward-jump -j "${FORWARD_CHAIN}"
|
||||
"${IPTABLES[@]}" -C "${FORWARD_CHAIN}" -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
|
||||
"${IPTABLES[@]}" -C "${FORWARD_CHAIN}" -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
|
||||
|
||||
"${IPTABLES[@]}" -t nat -C POSTROUTING -s "${VPN_CIDR}" -o "${EXT_IF}" -m comment --comment amneziawg-masquerade -j MASQUERADE
|
||||
awg show awg0 >/dev/null 2>&1
|
||||
|
||||
run.sh: |
|
||||
#!/usr/bin/env bash
|
||||
|
||||
@@ -123,20 +123,20 @@ spec:
|
||||
command:
|
||||
- /bin/bash
|
||||
- -lc
|
||||
- /scripts/firewall-check.sh 5847 10.8.0.0/16
|
||||
- awg show awg0 >/dev/null 2>&1
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 8
|
||||
failureThreshold: 2
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 3
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
- /bin/bash
|
||||
- -lc
|
||||
- /scripts/firewall-check.sh 5847 10.8.0.0/16
|
||||
- awg show awg0 >/dev/null 2>&1
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 8
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
resources:
|
||||
requests:
|
||||
|
||||
@@ -19,9 +19,6 @@ spec:
|
||||
spec:
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
securityContext:
|
||||
fsGroup: 1000
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
volumes:
|
||||
- name: creds
|
||||
persistentVolumeClaim:
|
||||
@@ -32,7 +29,7 @@ spec:
|
||||
imagePullPolicy: Always
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 3000
|
||||
containerPort: 8000
|
||||
protocol: TCP
|
||||
env:
|
||||
- name: ADMIN_PASSWORD
|
||||
@@ -41,10 +38,10 @@ spec:
|
||||
name: doka2-lobby-list-secrets
|
||||
key: ADMIN_PASSWORD
|
||||
- name: CREDS_DIR
|
||||
value: /data
|
||||
value: /data/creds
|
||||
volumeMounts:
|
||||
- name: creds
|
||||
mountPath: /data
|
||||
mountPath: /data/creds
|
||||
resources:
|
||||
requests:
|
||||
cpu: "50m"
|
||||
|
||||
@@ -23,4 +23,4 @@ spec:
|
||||
decodingStrategy: None
|
||||
metadataPolicy: None
|
||||
key: af4618dd-6431-4b20-b617-c00bae9ceff6
|
||||
property: login.password
|
||||
property: password
|
||||
|
||||
@@ -17,8 +17,6 @@ spec:
|
||||
labels:
|
||||
app: teamspeak
|
||||
spec:
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: music.tail2fe2d.ts.net
|
||||
volumes:
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
|
||||
@@ -1,26 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: argocd-dex-server
|
||||
namespace: argocd
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
containers:
|
||||
- name: dex-server
|
||||
readinessProbe:
|
||||
tcpSocket:
|
||||
port: 5556
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 3
|
||||
successThreshold: 1
|
||||
failureThreshold: 3
|
||||
livenessProbe:
|
||||
tcpSocket:
|
||||
port: 5556
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 3
|
||||
successThreshold: 1
|
||||
failureThreshold: 3
|
||||
@@ -16,5 +16,3 @@ helmCharts:
|
||||
valuesFile: values.yaml
|
||||
includeCRDs: true
|
||||
|
||||
patches:
|
||||
- path: dex-probes-patch.yaml
|
||||
|
||||
@@ -6,7 +6,7 @@ metadata:
|
||||
spec:
|
||||
project: core
|
||||
destination:
|
||||
namespace: longhorn-system
|
||||
namespace: longhorn
|
||||
server: https://kubernetes.default.svc
|
||||
source:
|
||||
repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
|
||||
|
||||
@@ -9,7 +9,7 @@ helmCharts:
|
||||
repo: https://charts.longhorn.io
|
||||
version: 1.12.0
|
||||
releaseName: longhorn
|
||||
namespace: longhorn-system
|
||||
namespace: longhorn
|
||||
valuesFile: values.yaml
|
||||
includeCRDs: true
|
||||
|
||||
|
||||
Reference in New Issue
Block a user