kunsi/bundlewrap
1
0
Fork 0
Code Issues 1 Pull requests 2 Releases Activity

bundles: use a common metadata key for firewall restrictions, use repo.libs.tools.resolve_identifier()
All checks were successful
bundlewrap/pipeline/head This commit looks good
Details

Browse source
This commit is contained in:
Franzi 2021-02-15 14:16:35 +01:00
parent 9a2f9038c4
commit 5c1eba0d58
Signed by: kunsi
GPG key ID: 12E3D2136B818350
8 changed files with 92 additions and 49 deletions
Download patch file Download diff file Expand all files Collapse all files

24
bundles/nginx/metadata.py
View file

@ -146,22 +146,28 @@ def monitoring(metadata):
'iptables/bundle_rules/nginx',
)
def iptables(metadata):
interfaces = metadata.get('nginx/restrict-to-interfaces', set())
rules = []
identifiers = metadata.get('nginx/restrict-to', set())
rules = set()
if interfaces:
for iface in sorted(interfaces):
rules.append(f'iptables_both -A INPUT -i {iface} -p tcp --dport 80 -j ACCEPT')
rules.append(f'iptables_both -A INPUT -i {iface} -p tcp --dport 443 -j ACCEPT')
if identifiers:
for identifier in sorted(identifiers):
resolved = repo.libs.tools.resolve_identifier(repo, identifier)
for address in resolved['ipv4']:
rules.add(f'iptables -A INPUT -p tcp -s {address} --dport 80 -j ACCEPT')
rules.add(f'iptables -A INPUT -p tcp -s {address} --dport 443 -j ACCEPT')
for address in resolved['ipv6']:
rules.add(f'ip6tables -A INPUT -p tcp -s {address} --dport 80 -j ACCEPT')
rules.add(f'ip6tables -A INPUT -p tcp -s {address} --dport 443 -j ACCEPT')
else:
rules.append('iptables_both -A INPUT -p tcp --dport 80 -j ACCEPT')
rules.append('iptables_both -A INPUT -p tcp --dport 443 -j ACCEPT')
rules.add('iptables_both -A INPUT -p tcp --dport 80 -j ACCEPT')
rules.add('iptables_both -A INPUT -p tcp --dport 443 -j ACCEPT')
return {
'iptables': {
'bundle_rules': {
'nginx': rules,
'nginx': list(sorted(rules)),
},
},
}