mirror of
https://github.com/dredx/prole.git
synced 2026-09-27 02:24:31 +00:00
792329ddd2
- k3s role: persist svc.prole.org reachability with a systemd oneshot that inserts ACCEPT rules ahead of Tailscale filter rules (configurable ports/chain). - init_monitoring: enable Grafana datasource sidecar and provision a stable Prometheus datasource (uid 'prometheus') so CloudNativePG dashboards bind correctly. - tests: assert datasource sidecar config and datasource ConfigMap is applied. Co-authored-by: Junie <junie@jetbrains.com>
42 lines
1.0 KiB
Django/Jinja
42 lines
1.0 KiB
Django/Jinja
#!/usr/bin/env bash
|
|
|
|
set -euo pipefail
|
|
|
|
CHAIN="{{ k3s_firewall_svc_allow_chain | default('PROLE-SVC-ALLOW') }}"
|
|
PORTS="{{ (k3s_firewall_svc_allow_tcp_ports | default([80, 443])) | join(' ') }}"
|
|
|
|
log() {
|
|
echo "[prole-svc-iptables-allow] $*" >&2
|
|
}
|
|
|
|
apply_rules() {
|
|
local ipt="$1"
|
|
|
|
command -v "$ipt" >/dev/null 2>&1 || return 0
|
|
|
|
# Ensure chain exists.
|
|
"$ipt" -t filter -N "$CHAIN" 2>/dev/null || true
|
|
"$ipt" -t filter -F "$CHAIN" || true
|
|
|
|
# Populate chain with port accepts.
|
|
for p in $PORTS; do
|
|
if [[ ! "$p" =~ ^[0-9]+$ ]]; then
|
|
log "Skipping non-numeric port: $p"
|
|
continue
|
|
fi
|
|
"$ipt" -t filter -A "$CHAIN" -p tcp --dport "$p" -j ACCEPT
|
|
done
|
|
|
|
# Ensure we jump to our chain at the very top of INPUT.
|
|
# Delete any existing jumps (wherever they are), then insert at position 1.
|
|
while "$ipt" -t filter -D INPUT -j "$CHAIN" 2>/dev/null; do
|
|
:
|
|
done
|
|
"$ipt" -t filter -I INPUT 1 -j "$CHAIN"
|
|
}
|
|
|
|
apply_rules iptables
|
|
apply_rules ip6tables
|
|
|
|
log "Applied ACCEPT rules for TCP ports: $PORTS"
|