dasandClaude Opus 5.5
acb7532a4f
- das-helpers replaces the dsv package and adds shared functions in /usr/lib/das/helpers.sh (bilingual messages, sudo re-exec, prompts). - dsv new creates a runit service (command, user, directory, environment, svlogd log) and checks it stays up; dsv rm deletes one not from a package. - duser: list, add (installer groups, --admin, key, password), del, passwd, lock/unlock (key logins too), key add|list|rm, groups +/-. - dfw: allow/deny/status/reload for the tcp_ports and udp_ports sets of the inet das table, kept in /etc/nftables.d/dfw.nft and checked with nft -c. - dsys: info, hostname, timezone, locale, keymap. - xtools-minimal on both images. - nftables.conf no longer suggests restarting the nftables service: its finish script flushes the whole ruleset, fail2ban's and Docker's included. - das-server-install 0.2.0 mentions the helpers when it finishes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
48 lines
1.4 KiB
Plaintext
48 lines
1.4 KiB
Plaintext
#!/usr/sbin/nft -f
|
|
# Das OS server firewall: incoming connections are closed except SSH.
|
|
#
|
|
# Open ports with dfw (dfw allow 80/tcp), which keeps them in
|
|
# /etc/nftables.d/dfw.nft. Ports that Docker containers publish (-p 8080:80)
|
|
# pass through Docker's own forwarding rules, not the input chain below.
|
|
#
|
|
# After editing this file: dfw reload. Only the "das" table is replaced, so the
|
|
# rules of Docker and fail2ban stay. Do not restart the nftables service for
|
|
# that: its finish script flushes the whole ruleset, theirs too.
|
|
|
|
table inet das
|
|
delete table inet das
|
|
|
|
table inet das {
|
|
# Filled by dfw
|
|
set tcp_ports {
|
|
type inet_service; flags interval; auto-merge;
|
|
}
|
|
set udp_ports {
|
|
type inet_service; flags interval; auto-merge;
|
|
}
|
|
|
|
chain input {
|
|
type filter hook input priority filter; policy drop;
|
|
|
|
ct state established,related accept
|
|
ct state invalid drop
|
|
iif lo accept
|
|
meta l4proto { icmp, ipv6-icmp } accept
|
|
# DHCPv6 answers come from the router's link-local address
|
|
ip6 saddr fe80::/10 udp dport dhcpv6-client accept
|
|
# Containers may reach services on the host (DNS, a database...)
|
|
iifname "docker0" accept
|
|
iifname "br-*" accept
|
|
|
|
tcp dport ssh accept
|
|
tcp dport @tcp_ports accept
|
|
udp dport @udp_ports accept
|
|
|
|
# Rules of your own go here, e.g. a port for one network only:
|
|
# ip saddr 192.168.1.0/24 tcp dport 5432 accept
|
|
}
|
|
}
|
|
|
|
# dfw's ports and drop-ins of your own
|
|
include "/etc/nftables.d/*.nft"
|