ippadmin/itpp-infrastructure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Sync docs, audit artifacts, project notes, and VerdictTank proposal docs

Browse Source 
- audit/phase-one + phase-two: security audit briefs, findings, credential-rotation plan, Docker-USER hardening scripts, rollback refs
- disaster-recovery/restore-test-log.md + backup-dr-audit-2026-08-10.md
- clients/ (modelortho SEO audit, ai-biz-dev competitive landscape), notes/ (tiktok strategy)
- projects/: front-desk-voice-agent, seo-visibility-checker product plan, hotnow-savannah HTML, resend-transactional-email, backup-dashboard-enhancements, code-review-graph, seo-ci-architecture
- proposals/verdicttank/: architecture v4.0, methodology, judge-pool review, consolidation reasoning, cross-check review
- docs/super-search/firecrawl-provider-strategy.md
- updates: CHANGELOG, model-chain, projects-master-readme, intelsight.io
- .gitignore: exclude nested standalone repos (seo-tool, venturebuilt)
This commit is contained in:
root
2026-08-26 02:27:28 -04:00
parent 23e9751d38
commit f5175f1ce0
55 changed files with 14669 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
audit/phase-two/scripts/app1-docker-user.sh
+30
View File
@@ -0,0 +1,30 @@
#!/bin/bash
# ITPP Phase Two C1 - DOCKER-USER hardening (management consoles Tailscale-only)
# Host: app1 (152.53.36.131) | Applied 2026-08-13 | Authorized: Phase Two Workstream 1 C1 (Germaine)
# Idempotent: flushes and rebuilds DOCKER-USER (IPv4 + IPv6). Safe to re-run manually.
# Closes (Tailscale-only): komodo 9120, twenty-server 3003, wazuh dashboard 5601, wazuh indexer 9200.
# Preserves (public): wazuh manager 1514/1515/55000 tcp + 514 udp (5 active agents).
# NOTE: litellm is 127.0.0.1:4000 behind Caddy (admin-ai.itpropartner.com) - untouched here.
set -eu
if ! iptables -L DOCKER-USER -n >/dev/null 2>&1; then
iptables -N DOCKER-USER
fi
iptables -F DOCKER-USER
iptables -A DOCKER-USER -s 100.64.0.0/10 -j RETURN
iptables -A DOCKER-USER -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
iptables -A DOCKER-USER -i eth0 -p tcp -m multiport --dports 1514,1515,55000 -j RETURN
iptables -A DOCKER-USER -i eth0 -p udp -m multiport --dports 514 -j RETURN
iptables -A DOCKER-USER -i eth0 -j DROP
iptables -A DOCKER-USER -j RETURN
if ip6tables -L DOCKER-USER -n >/dev/null 2>&1; then
ip6tables -F DOCKER-USER
ip6tables -A DOCKER-USER -s fd7a:115c:a1e0::/48 -j RETURN
ip6tables -A DOCKER-USER -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
ip6tables -A DOCKER-USER -i eth0 -p tcp -m multiport --dports 1514,1515,55000 -j RETURN
ip6tables -A DOCKER-USER -i eth0 -p udp -m multiport --dports 514 -j RETURN
ip6tables -A DOCKER-USER -i eth0 -j DROP
ip6tables -A DOCKER-USER -j RETURN
fi
exit 0
audit/phase-two/scripts/app2-docker-user.sh
+42
View File
@@ -0,0 +1,42 @@
#!/bin/bash
# ITPP Phase Two C1 - DOCKER-USER hardening (management consoles Tailscale-only)
# Host: app2 (152.53.39.202) | Applied 2026-08-13 | Authorized: Phase Two Workstream 1 C1 (Germaine)
# Idempotent: flushes and rebuilds DOCKER-USER (IPv4 + IPv6). Safe to re-run manually.
#
# Closes (Tailscale-only, dropped by the final eth0 DROP; admin UIs still reachable via Caddy :443 -> localhost):
# unifi-controller admin UI 8443 + guest portal 8843/8880 (unifi.itpropartner.com -> Caddy -> localhost:8443);
# unms-nginx admin UI 8444 + http 81 (unms.forefrontwireless.com -> Caddy -> localhost:8444);
# minio console 9001, infinity 23817+23820, ragflow 9380-9384+9392+9393 (ragflow.itpropartner.com -> Caddy -> localhost:9392);
# gitea ssh 3022 (web is 127.0.0.1:3001 -> Caddy git.itpropartner.com).
# Preserves (public):
# technitium DNS 53 tcp+udp;
# bookstack 6875 (published 6875 -> container 80, matched via ctorigdstport; app3 support site proxies here);
# support-api 6880 (app3 support.itpropartner.com -> 152.53.39.202:6880);
# traccar 8082 + 5000-5150 tcp+udp (GPS devices + Core Caddy cross-proxy);
# unifi-controller 8080 tcp (23 remote devices inform here) + 3478/10001 udp (STUN/discovery);
# unms-nginx 8089 tcp + unms-netflow 2055 udp (UISP device-facing; conservative - see change log notes).
set -eu
if ! iptables -L DOCKER-USER -n >/dev/null 2>&1; then
iptables -N DOCKER-USER
fi
iptables -F DOCKER-USER
iptables -A DOCKER-USER -s 100.64.0.0/10 -j RETURN
iptables -A DOCKER-USER -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
iptables -A DOCKER-USER -i eth0 -p tcp -m multiport --dports 53,6880,8080,8082,8089,5000:5150 -j RETURN
iptables -A DOCKER-USER -i eth0 -p tcp -m conntrack --ctorigdstport 6875 -j RETURN
iptables -A DOCKER-USER -i eth0 -p udp -m multiport --dports 53,2055,3478,10001,5000:5150 -j RETURN
iptables -A DOCKER-USER -i eth0 -j DROP
iptables -A DOCKER-USER -j RETURN
if ip6tables -L DOCKER-USER -n >/dev/null 2>&1; then
ip6tables -F DOCKER-USER
ip6tables -A DOCKER-USER -s fd7a:115c:a1e0::/48 -j RETURN
ip6tables -A DOCKER-USER -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
ip6tables -A DOCKER-USER -i eth0 -p tcp -m multiport --dports 53,6880,8080,8082,8089,5000:5150 -j RETURN
ip6tables -A DOCKER-USER -i eth0 -p tcp -m conntrack --ctorigdstport 6875 -j RETURN
ip6tables -A DOCKER-USER -i eth0 -p udp -m multiport --dports 53,2055,3478,10001,5000:5150 -j RETURN
ip6tables -A DOCKER-USER -i eth0 -j DROP
ip6tables -A DOCKER-USER -j RETURN
fi
exit 0
audit/phase-two/scripts/app3-docker-user.sh
+25
View File
@@ -0,0 +1,25 @@
#!/bin/bash
# ITPP Phase Two C1 - DOCKER-USER hardening (management consoles Tailscale-only)
# Host: app3 (152.53.241.111) | Applied 2026-08-13 | Authorized: Phase Two Workstream 1 C1 (Germaine)
# Idempotent: flushes and rebuilds DOCKER-USER (IPv4 + IPv6). Safe to re-run manually.
# Closes (Tailscale-only): buzz-prod-relay 3000/tcp (publicly served via nginx loopback buzz.iamgmb.com).
# Preserves: none (hexclave 8101-8102 is loopback; nginx 80/443 is host INPUT chain).
set -eu
if ! iptables -L DOCKER-USER -n >/dev/null 2>&1; then
iptables -N DOCKER-USER
fi
iptables -F DOCKER-USER
iptables -A DOCKER-USER -s 100.64.0.0/10 -j RETURN
iptables -A DOCKER-USER -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
iptables -A DOCKER-USER -i eth0 -j DROP
iptables -A DOCKER-USER -j RETURN
if ip6tables -L DOCKER-USER -n >/dev/null 2>&1; then
ip6tables -F DOCKER-USER
ip6tables -A DOCKER-USER -s fd7a:115c:a1e0::/48 -j RETURN
ip6tables -A DOCKER-USER -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
ip6tables -A DOCKER-USER -i eth0 -j DROP
ip6tables -A DOCKER-USER -j RETURN
fi
exit 0
audit/phase-two/scripts/core-docker-user.sh
+21
View File
@@ -0,0 +1,21 @@
#!/bin/bash
# ITPP Phase Two C1 - DOCKER-USER hardening (management consoles Tailscale-only)
# Host: core (152.53.192.33) | Applied 2026-08-13 | Authorized: Phase Two Workstream 1 C1 (Germaine)
# Idempotent: flushes and rebuilds the DOCKER-USER chain. Safe to re-run manually.
# Closes (Tailscale-only): browserless 3000/tcp, camofox-browser 9377/tcp, uptime-kuma 3001/tcp.
# Preserves: none (no public Docker services on core; Caddy 80/443 is host INPUT chain).
set -eu
if ! iptables -L DOCKER-USER -n >/dev/null 2>&1; then
iptables -N DOCKER-USER
fi
iptables -F DOCKER-USER
iptables -A DOCKER-USER -s 100.64.0.0/10 -j RETURN
iptables -A DOCKER-USER -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
iptables -A DOCKER-USER -i eth0 -j DROP
iptables -A DOCKER-USER -j RETURN
# IPv6: Docker ip6tables integration is off on core (no ip6tables DOCKER-USER chain,
# no IPv6 DNAT). [::] publishes are userland docker-proxy (INPUT path) and are already
# blocked by UFW IPv6 default-deny (only 22/80/443/8080-tailscale/51821/8890 allowed).
exit 0
audit/phase-two/scripts/itpp-docker-user.service
+12
View File
@@ -0,0 +1,12 @@
[Unit]
Description=ITPP P2-C1 DOCKER-USER firewall hardening (Tailscale-only management consoles)
After=docker.service
Wants=docker.service
[Service]
Type=oneshot
ExecStart=/usr/local/sbin/itpp-docker-user.sh
RemainAfterExit=yes
[Install]
WantedBy=multi-user.target