dasandClaude Opus 5.5
eba4516998
- server/ profile and build-iso.sh [desktop|server]; make iso-server, make qemu-server, run-qemu.sh --serial; login on tty and ttyS0 - das-server: SSH, chrony, NetworkManager/dhcpcd, Docker with Compose, nftables (closed except SSH, own table), fail2ban reading socklog, sshd without root passwords, Docker log rotation, tools - das-server-install: dialog installer in Ukrainian and English, or unattended with --config; GPT + Btrfs subvolumes, GRUB for UEFI and BIOS, serial console, SSH key with optional keys-only logins - das-install-common: mount-source and postinstall shared with Calamares - dsv: runit service manager (list, enable, disable, start, stop, restart, status, logs) with bash completion, also on the desktop - das-update split into a subpackage without GTK; the window and tray icon move to /usr/libexec/das/das-update-gui - das-snapper-setup enables dbus, which snapper needs - TODO: ISO size review with measured numbers and options Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
32 lines
943 B
Plaintext
32 lines
943 B
Plaintext
#!/usr/sbin/nft -f
|
|
# Das OS server firewall: incoming connections are closed except SSH.
|
|
#
|
|
# Only the "das" table is replaced, so loading this file again
|
|
# (dsv restart nftables) keeps the rules of Docker and fail2ban.
|
|
# Ports that Docker containers publish (-p 8080:80) pass through Docker's
|
|
# own forwarding rules, not the input chain below.
|
|
|
|
table inet das
|
|
delete table inet das
|
|
|
|
table inet das {
|
|
chain input {
|
|
type filter hook input priority filter; policy drop;
|
|
|
|
ct state established,related accept
|
|
ct state invalid drop
|
|
iif lo accept
|
|
meta l4proto { icmp, ipv6-icmp } accept
|
|
# DHCPv6 answers come from the router's link-local address
|
|
ip6 saddr fe80::/10 udp dport dhcpv6-client accept
|
|
# Containers may reach services on the host (DNS, a database...)
|
|
iifname "docker0" accept
|
|
iifname "br-*" accept
|
|
|
|
tcp dport ssh accept
|
|
|
|
# Open more ports here, then: dsv restart nftables
|
|
# tcp dport { http, https } accept
|
|
}
|
|
}
|