Sergei Poljanski
dc0f732d0f
Checked against the Hetzner project: - Both servers have daily backups and delete and rebuild protection switched on, while the code said backups = false and set no protection. An apply would have turned all three off and discarded the existing backups. Record them as they are. - The firewalls had drifted both ways. Live, asxpio-ops also accepts XMPP ports and tcp/5000, and asxpio-services accepts 80, 443, XMPP, TURN, Valheim and Factorio ports; none of those services run. The code in turn missed tcp/25566, where the second Minecraft server listens. Describe the firewalls as they should be: internal networks, plus the public ports of services that run. Public SSH to asxpio-services goes too; sshd and iptables already refuse it from outside the VPN. This is not applied. The next plan will show the stale ports being closed and nothing else. Assisted-by: Claude:fable-5-2
79 lines
1.8 KiB
HCL
79 lines
1.8 KiB
HCL
# Only ports of services that actually run are open to the internet.
|
|
# Everything else is reachable from the private network and WireGuard.
|
|
|
|
locals {
|
|
internal_networks = ["10.10.0.0/20", "10.20.0.0/24"] # VPC, WireGuard
|
|
anywhere = ["0.0.0.0/0", "::/0"]
|
|
|
|
ops_public = [
|
|
{ protocol = "tcp", port = "22" }, # git over SSH (Forgejo); shell users are limited by sshd
|
|
{ protocol = "tcp", port = "80" }, # Traefik
|
|
{ protocol = "tcp", port = "443" }, # Traefik
|
|
{ protocol = "udp", port = "60101" }, # WireGuard
|
|
]
|
|
|
|
services_public = [
|
|
{ protocol = "tcp", port = "25565-25566" }, # Minecraft (Paper, Fossils)
|
|
{ protocol = "udp", port = "19132" }, # Minecraft Bedrock (Geyser)
|
|
]
|
|
}
|
|
|
|
resource "hcloud_firewall" "ops_fw" {
|
|
name = "asxpio-ops-fw"
|
|
|
|
dynamic "rule" {
|
|
for_each = ["tcp", "udp"]
|
|
content {
|
|
direction = "in"
|
|
protocol = rule.value
|
|
port = "any"
|
|
source_ips = local.internal_networks
|
|
}
|
|
}
|
|
|
|
rule {
|
|
direction = "in"
|
|
protocol = "icmp"
|
|
source_ips = local.internal_networks
|
|
}
|
|
|
|
dynamic "rule" {
|
|
for_each = local.ops_public
|
|
content {
|
|
direction = "in"
|
|
protocol = rule.value.protocol
|
|
port = rule.value.port
|
|
source_ips = local.anywhere
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "hcloud_firewall" "services_fw" {
|
|
name = "asxpio-services-fw"
|
|
|
|
dynamic "rule" {
|
|
for_each = ["tcp", "udp"]
|
|
content {
|
|
direction = "in"
|
|
protocol = rule.value
|
|
port = "any"
|
|
source_ips = local.internal_networks
|
|
}
|
|
}
|
|
|
|
rule {
|
|
direction = "in"
|
|
protocol = "icmp"
|
|
source_ips = local.internal_networks
|
|
}
|
|
|
|
dynamic "rule" {
|
|
for_each = local.services_public
|
|
content {
|
|
direction = "in"
|
|
protocol = rule.value.protocol
|
|
port = rule.value.port
|
|
source_ips = local.anywhere
|
|
}
|
|
}
|
|
}
|