Git-Mirrors/graphene-os-server-infrastructure
1
0
Fork 0
mirror of https://github.com/GrapheneOS/infrastructure.git synced 2025-07-24 23:35:40 -04:00
Code Issues Projects Releases Packages Wiki Activity

set up certificate replication for ns1 replicas

Browse source
This commit is contained in:
Daniel Micay 2025-05-03 22:13:13 -04:00
parent 4a9deb48ab
commit 029882f051
2 changed files with 13 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

16
etc/nftables/nftables-ns1.conf
View file

@ -3,6 +3,14 @@
flush ruleset flush ruleset
table inet filter { table inet filter {
define ip-allowlist-ssh = {
51.161.34.158, # 0.ns1.grapheneos.org
}
define ip6-allowlist-ssh = {
2607:5300:205:200::eaa, # 0.ns1.grapheneos.org
}
set ip-connlimit-ssh { set ip-connlimit-ssh {
type ipv4_addr type ipv4_addr
flags dynamic flags dynamic
@ -79,8 +87,8 @@ table inet filter {
# add connections established without synproxy to connection limit sets with limits enforced # add connections established without synproxy to connection limit sets with limits enforced
chain input-tcp-service-established { chain input-tcp-service-established {
ct mark 0x1 accept ct mark 0x1 accept
tcp dport 22 add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
tcp dport 22 add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } counter reject with tcp reset tcp dport 22 ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } counter reject with tcp reset
tcp dport { 53, 80, 443, 853 } add @ip-connlimit-main { ip saddr ct count over 16 } counter reject with tcp reset tcp dport { 53, 80, 443, 853 } add @ip-connlimit-main { ip saddr ct count over 16 } counter reject with tcp reset
tcp dport { 53, 80, 443, 853 } add @ip6-connlimit-main { ip6 saddr and ffff:ffff:ffff:ffff:: ct count over 16 } counter reject with tcp reset tcp dport { 53, 80, 443, 853 } add @ip6-connlimit-main { ip6 saddr and ffff:ffff:ffff:ffff:: ct count over 16 } counter reject with tcp reset
ct mark set 0x1 accept ct mark set 0x1 accept
@ -89,8 +97,8 @@ table inet filter {
# add connections established with synproxy to connection limit sets with limits enforced # add connections established with synproxy to connection limit sets with limits enforced
chain input-tcp-service-loopback { chain input-tcp-service-loopback {
tcp flags != syn accept tcp flags != syn accept
tcp dport 22 add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
tcp dport 22 add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } counter reject with tcp reset tcp dport 22 ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } counter reject with tcp reset
tcp dport { 53, 80, 443, 853 } add @ip-connlimit-main { ip saddr ct count over 16 } counter reject with tcp reset tcp dport { 53, 80, 443, 853 } add @ip-connlimit-main { ip saddr ct count over 16 } counter reject with tcp reset
tcp dport { 53, 80, 443, 853 } add @ip6-connlimit-main { ip6 saddr and ffff:ffff:ffff:ffff:: ct count over 16 } counter reject with tcp reset tcp dport { 53, 80, 443, 853 } add @ip6-connlimit-main { ip6 saddr and ffff:ffff:ffff:ffff:: ct count over 16 } counter reject with tcp reset
ct mark set 0x1 accept ct mark set 0x1 accept

1
hosts.sh
View file

@ -44,6 +44,7 @@ declare -Ar hosts_hardware_watchdog=(
) )
declare -Ar hosts_authorized_keys=( declare -Ar hosts_authorized_keys=(
[2.ns1.grapheneos.org]=authorized_keys-replica-ns1
[1.ns2.grapheneos.org]=authorized_keys-replica-ns2 [1.ns2.grapheneos.org]=authorized_keys-replica-ns2
[2.ns2.grapheneos.org]=authorized_keys-replica-ns2 [2.ns2.grapheneos.org]=authorized_keys-replica-ns2
[1.grapheneos.org]=authorized_keys-replica-grapheneos [1.grapheneos.org]=authorized_keys-replica-grapheneos