PTah
60 lines
1.4 KiB
Bash
60 lines
1.4 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# Базовая настройка UFW под схему own-git.
|
|
# ВНИМАНИЕ: проверьте, что доступ к серверу по SSH есть до включения firewall.
|
|
|
|
ALLOW_SSH_PORT="${ALLOW_SSH_PORT:-22}"
|
|
ALLOW_GITEA_SSH_PORT="${ALLOW_GITEA_SSH_PORT:-2222}"
|
|
ALLOW_HTTP="${ALLOW_HTTP:-true}"
|
|
ALLOW_HTTPS="${ALLOW_HTTPS:-true}"
|
|
ALLOW_SMTP="${ALLOW_SMTP:-true}"
|
|
ALLOW_RDP="${ALLOW_RDP:-true}"
|
|
RDP_PORT="${RDP_PORT:-3389}"
|
|
|
|
if [[ "${EUID:-$(id -u)}" -ne 0 ]]; then
|
|
echo "[ERR] Run as root (sudo)."
|
|
exit 1
|
|
fi
|
|
|
|
if ! command -v ufw >/dev/null 2>&1; then
|
|
echo "[INFO] Installing ufw..."
|
|
apt-get update
|
|
apt-get install -y ufw
|
|
fi
|
|
|
|
echo "[INFO] Reset UFW rules"
|
|
ufw --force reset
|
|
|
|
echo "[INFO] Set default policy"
|
|
ufw default deny incoming
|
|
ufw default allow outgoing
|
|
|
|
echo "[INFO] Allow SSH management port: ${ALLOW_SSH_PORT}/tcp"
|
|
ufw allow "${ALLOW_SSH_PORT}/tcp"
|
|
|
|
echo "[INFO] Allow Gitea SSH via HAProxy: ${ALLOW_GITEA_SSH_PORT}/tcp"
|
|
ufw allow "${ALLOW_GITEA_SSH_PORT}/tcp"
|
|
|
|
if [[ "$ALLOW_HTTP" == "true" ]]; then
|
|
ufw allow 80/tcp
|
|
fi
|
|
|
|
if [[ "$ALLOW_HTTPS" == "true" ]]; then
|
|
ufw allow 443/tcp
|
|
fi
|
|
|
|
if [[ "$ALLOW_SMTP" == "true" ]]; then
|
|
ufw allow 25/tcp
|
|
fi
|
|
|
|
if [[ "$ALLOW_RDP" == "true" ]]; then
|
|
ufw allow "${RDP_PORT}/tcp"
|
|
fi
|
|
|
|
echo "[INFO] Enable UFW"
|
|
ufw --force enable
|
|
|
|
echo "[OK] UFW configured"
|
|
ufw status verbose
|