mirror of
https://github.com/GrapheneOS/infrastructure.git
synced 2025-07-02 18:36:45 -04:00
set up certificate replication for ns1 replicas
This commit is contained in:
parent
4a9deb48ab
commit
029882f051
2 changed files with 13 additions and 4 deletions
|
@ -3,6 +3,14 @@
|
|||
flush ruleset
|
||||
|
||||
table inet filter {
|
||||
define ip-allowlist-ssh = {
|
||||
51.161.34.158, # 0.ns1.grapheneos.org
|
||||
}
|
||||
|
||||
define ip6-allowlist-ssh = {
|
||||
2607:5300:205:200::eaa, # 0.ns1.grapheneos.org
|
||||
}
|
||||
|
||||
set ip-connlimit-ssh {
|
||||
type ipv4_addr
|
||||
flags dynamic
|
||||
|
@ -79,8 +87,8 @@ table inet filter {
|
|||
# add connections established without synproxy to connection limit sets with limits enforced
|
||||
chain input-tcp-service-established {
|
||||
ct mark 0x1 accept
|
||||
tcp dport 22 add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
|
||||
tcp dport 22 add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } counter reject with tcp reset
|
||||
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
|
||||
tcp dport 22 ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } counter reject with tcp reset
|
||||
tcp dport { 53, 80, 443, 853 } add @ip-connlimit-main { ip saddr ct count over 16 } counter reject with tcp reset
|
||||
tcp dport { 53, 80, 443, 853 } add @ip6-connlimit-main { ip6 saddr and ffff:ffff:ffff:ffff:: ct count over 16 } counter reject with tcp reset
|
||||
ct mark set 0x1 accept
|
||||
|
@ -89,8 +97,8 @@ table inet filter {
|
|||
# add connections established with synproxy to connection limit sets with limits enforced
|
||||
chain input-tcp-service-loopback {
|
||||
tcp flags != syn accept
|
||||
tcp dport 22 add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
|
||||
tcp dport 22 add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } counter reject with tcp reset
|
||||
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
|
||||
tcp dport 22 ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } counter reject with tcp reset
|
||||
tcp dport { 53, 80, 443, 853 } add @ip-connlimit-main { ip saddr ct count over 16 } counter reject with tcp reset
|
||||
tcp dport { 53, 80, 443, 853 } add @ip6-connlimit-main { ip6 saddr and ffff:ffff:ffff:ffff:: ct count over 16 } counter reject with tcp reset
|
||||
ct mark set 0x1 accept
|
||||
|
|
1
hosts.sh
1
hosts.sh
|
@ -44,6 +44,7 @@ declare -Ar hosts_hardware_watchdog=(
|
|||
)
|
||||
|
||||
declare -Ar hosts_authorized_keys=(
|
||||
[2.ns1.grapheneos.org]=authorized_keys-replica-ns1
|
||||
[1.ns2.grapheneos.org]=authorized_keys-replica-ns2
|
||||
[2.ns2.grapheneos.org]=authorized_keys-replica-ns2
|
||||
[1.grapheneos.org]=authorized_keys-replica-grapheneos
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue