max / makenotwork

1.2 KB · 46 lines History Blame Raw

1	#!/bin/bash
2	# Firewall setup for Makenotwork production server (ufw).
3	#
4	# Rules:
5	# - Allow all traffic on Tailscale interface (tailscale0)
6	# - Allow SSH (port 22) from anywhere (needed for git SSH access)
7	# - Allow HTTP/HTTPS (80/443) from anywhere (custom domains need direct access)
8	# - Drop everything else
9	#
10	# HTTP/HTTPS is open to all because custom domains bypass Cloudflare.
11	# makenot.work subdomains remain protected by Caddy mTLS (Authenticated Origin Pulls):
12	# requests without a valid Cloudflare client cert are rejected by Caddy before
13	# reaching the application.
14
15	set -e
16
17	if [ "$(id -u)" -ne 0 ]; then
18	echo "Error: Run as root"
19	exit 1
20	fi
21
22	# Reset to defaults
23	ufw --force reset
24
25	# Default policies
26	ufw default deny incoming
27	ufw default allow outgoing
28
29	# Tailscale — unrestricted
30	ufw allow in on tailscale0
31
32	# SSH — open from anywhere (git clone over SSH)
33	ufw allow 22/tcp
34
35	# HTTP/HTTPS — open to all (custom domains need direct access)
36	# makenot.work is still protected by Caddy mTLS (Authenticated Origin Pulls)
37	ufw allow 80/tcp
38	ufw allow 443/tcp
39
40	# Enable
41	ufw --force enable
42	ufw status verbose
43
44	echo ""
45	echo "Firewall configured. SSH, HTTP, HTTPS open. makenot.work protected by Caddy mTLS."
46