docs(security): план UFW, hardening HAProxy и бэкендов, скрипты deploy.

2026-06-13 21:27:49 +10:00
parent f26d52b3b4
commit 787671f9ca
13 changed files with 679 additions and 0 deletions
@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+# UFW для HAProxy: default deny, SSH из SSH_ALLOWED, inbound 25/80/443.
+# Dry-run по умолчанию; --apply для включения.
+#
+#   cp haproxy-ufw.env.example /etc/haproxy/security/haproxy-ufw.env
+#   ./haproxy-ufw-apply.sh
+#   ./haproxy-ufw-apply.sh --apply
+set -Eeuo pipefail
+
+ENV_FILE="${HAPROXY_UFW_ENV:-/etc/haproxy/security/haproxy-ufw.env}"
+APPLY=0
+
+die() { echo "error: $*" >&2; exit 1; }
+log() { echo "[*] $*"; }
+
+usage() {
+    cat <<'EOF'
+Usage: haproxy-ufw-apply.sh [--apply] [--env-file PATH]
+
+  --apply       выполнить ufw enable/reset (иначе только показ команд)
+  --env-file    путь к env (default: /etc/haproxy/security/haproxy-ufw.env)
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --apply) APPLY=1; shift ;;
+        --env-file) ENV_FILE=$2; shift 2 ;;
+        -h | --help) usage; exit 0 ;;
+        *) die "unknown option: $1" ;;
+    esac
+done
+
+[[ -f $ENV_FILE ]] || die "missing env: $ENV_FILE (copy from haproxy-ufw.env.example)"
+
+# shellcheck source=/dev/null
+source "$ENV_FILE"
+
+SSH_ALLOWED=${SSH_ALLOWED:-}
+INBOUND_TCP=${INBOUND_TCP:-25 80 443}
+UFW_IPV6=${UFW_IPV6:-no}
+
+[[ -n $SSH_ALLOWED ]] || die "SSH_ALLOWED is empty — lockout risk"
+
+command -v ufw >/dev/null 2>&1 || die "ufw not installed (apt install ufw)"
+
+run() {
+    log "$*"
+    [[ $APPLY -eq 1 ]] && "$@"
+}
+
+if [[ $APPLY -eq 0 ]]; then
+    echo "=== DRY-RUN (pass --apply to execute) ==="
+fi
+
+if [[ $APPLY -eq 1 ]]; then
+    sed -i "s/^IPV6=.*/IPV6=${UFW_IPV6}/" /etc/default/ufw 2>/dev/null || true
+fi
+
+run ufw --force reset
+run ufw default deny incoming
+run ufw default allow outgoing
+
+for cidr in $SSH_ALLOWED; do
+    run ufw allow from "$cidr" to any port 22 proto tcp comment 'admin ssh'
+done
+
+for port in $INBOUND_TCP; do
+    run ufw allow "$port/tcp" comment "haproxy service $port"
+done
+
+if [[ $APPLY -eq 1 ]]; then
+    ufw --force enable
+    ufw status verbose
+    log "done"
+else
+    echo "=== end dry-run ==="
+fi