das/Das-OS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Stage 7: command-line helpers dsv, duser, dfw, dsys (0.5.0)

Browse Source 
- das-helpers replaces the dsv package and adds shared functions in
  /usr/lib/das/helpers.sh (bilingual messages, sudo re-exec, prompts).
- dsv new creates a runit service (command, user, directory, environment,
  svlogd log) and checks it stays up; dsv rm deletes one not from a package.
- duser: list, add (installer groups, --admin, key, password), del, passwd,
  lock/unlock (key logins too), key add|list|rm, groups +/-.
- dfw: allow/deny/status/reload for the tcp_ports and udp_ports sets of the
  inet das table, kept in /etc/nftables.d/dfw.nft and checked with nft -c.
- dsys: info, hostname, timezone, locale, keymap.
- xtools-minimal on both images.
- nftables.conf no longer suggests restarting the nftables service: its
  finish script flushes the whole ruleset, fail2ban's and Docker's included.
- das-server-install 0.2.0 mentions the helpers when it finishes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
das
2026-10-20 06:58:25 +03:00
co-authored by Claude Opus 5.5
parent 84768962fc
commit acb7532a4f
21 changed files with 1342 additions and 99 deletions
Download Patch File Download Diff File Expand all files Collapse all files
srcpkgs/das-server/files/nftables.conf
+22 -6
View File
@@ -1,15 +1,26 @@
#!/usr/sbin/nft -f
# Das OS server firewall: incoming connections are closed except SSH.
#
# Only the "das" table is replaced, so loading this file again
# (dsv restart nftables) keeps the rules of Docker and fail2ban.
# Ports that Docker containers publish (-p 8080:80) pass through Docker's
# own forwarding rules, not the input chain below.
# Open ports with dfw (dfw allow 80/tcp), which keeps them in
# /etc/nftables.d/dfw.nft. Ports that Docker containers publish (-p 8080:80)
# pass through Docker's own forwarding rules, not the input chain below.
#
# After editing this file: dfw reload. Only the "das" table is replaced, so the
# rules of Docker and fail2ban stay. Do not restart the nftables service for
# that: its finish script flushes the whole ruleset, theirs too.
table inet das
delete table inet das
table inet das {
# Filled by dfw
set tcp_ports {
type inet_service; flags interval; auto-merge;
}
set udp_ports {
type inet_service; flags interval; auto-merge;
}
chain input {
type filter hook input priority filter; policy drop;
@@ -24,8 +35,13 @@ table inet das {
iifname "br-*" accept
tcp dport ssh accept
tcp dport @tcp_ports accept
udp dport @udp_ports accept
# Open more ports here, then: dsv restart nftables
# tcp dport { http, https } accept
# Rules of your own go here, e.g. a port for one network only:
# ip saddr 192.168.1.0/24 tcp dport 5432 accept
}
}
# dfw's ports and drop-ins of your own
include "/etc/nftables.d/*.nft"