Initial own-git docs, configs, scripts, and hardening pack

2026-04-21 21:37:43 +10:00
commit f5899ebc56
25 changed files with 1843 additions and 0 deletions
@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Базовая настройка UFW под схему own-git.
+# ВНИМАНИЕ: проверьте, что доступ к серверу по SSH есть до включения firewall.
+
+ALLOW_SSH_PORT="${ALLOW_SSH_PORT:-22}"
+ALLOW_GITEA_SSH_PORT="${ALLOW_GITEA_SSH_PORT:-2222}"
+ALLOW_HTTP="${ALLOW_HTTP:-true}"
+ALLOW_HTTPS="${ALLOW_HTTPS:-true}"
+ALLOW_SMTP="${ALLOW_SMTP:-true}"
+ALLOW_RDP="${ALLOW_RDP:-true}"
+RDP_PORT="${RDP_PORT:-3389}"
+
+if [[ "${EUID:-$(id -u)}" -ne 0 ]]; then
+  echo "[ERR] Run as root (sudo)."
+  exit 1
+fi
+
+if ! command -v ufw >/dev/null 2>&1; then
+  echo "[INFO] Installing ufw..."
+  apt-get update
+  apt-get install -y ufw
+fi
+
+echo "[INFO] Reset UFW rules"
+ufw --force reset
+
+echo "[INFO] Set default policy"
+ufw default deny incoming
+ufw default allow outgoing
+
+echo "[INFO] Allow SSH management port: ${ALLOW_SSH_PORT}/tcp"
+ufw allow "${ALLOW_SSH_PORT}/tcp"
+
+echo "[INFO] Allow Gitea SSH via HAProxy: ${ALLOW_GITEA_SSH_PORT}/tcp"
+ufw allow "${ALLOW_GITEA_SSH_PORT}/tcp"
+
+if [[ "$ALLOW_HTTP" == "true" ]]; then
+  ufw allow 80/tcp
+fi
+
+if [[ "$ALLOW_HTTPS" == "true" ]]; then
+  ufw allow 443/tcp
+fi
+
+if [[ "$ALLOW_SMTP" == "true" ]]; then
+  ufw allow 25/tcp
+fi
+
+if [[ "$ALLOW_RDP" == "true" ]]; then
+  ufw allow "${RDP_PORT}/tcp"
+fi
+
+echo "[INFO] Enable UFW"
+ufw --force enable
+
+echo "[OK] UFW configured"
+ufw status verbose