root
f5175f1ce0
- audit/phase-one + phase-two: security audit briefs, findings, credential-rotation plan, Docker-USER hardening scripts, rollback refs - disaster-recovery/restore-test-log.md + backup-dr-audit-2026-08-10.md - clients/ (modelortho SEO audit, ai-biz-dev competitive landscape), notes/ (tiktok strategy) - projects/: front-desk-voice-agent, seo-visibility-checker product plan, hotnow-savannah HTML, resend-transactional-email, backup-dashboard-enhancements, code-review-graph, seo-ci-architecture - proposals/verdicttank/: architecture v4.0, methodology, judge-pool review, consolidation reasoning, cross-check review - docs/super-search/firecrawl-provider-strategy.md - updates: CHANGELOG, model-chain, projects-master-readme, intelsight.io - .gitignore: exclude nested standalone repos (seo-tool, venturebuilt)
26 lines
1.1 KiB
Bash
26 lines
1.1 KiB
Bash
#!/bin/bash
|
|
# ITPP Phase Two C1 - DOCKER-USER hardening (management consoles Tailscale-only)
|
|
# Host: app3 (152.53.241.111) | Applied 2026-08-13 | Authorized: Phase Two Workstream 1 C1 (Germaine)
|
|
# Idempotent: flushes and rebuilds DOCKER-USER (IPv4 + IPv6). Safe to re-run manually.
|
|
# Closes (Tailscale-only): buzz-prod-relay 3000/tcp (publicly served via nginx loopback buzz.iamgmb.com).
|
|
# Preserves: none (hexclave 8101-8102 is loopback; nginx 80/443 is host INPUT chain).
|
|
set -eu
|
|
|
|
if ! iptables -L DOCKER-USER -n >/dev/null 2>&1; then
|
|
iptables -N DOCKER-USER
|
|
fi
|
|
iptables -F DOCKER-USER
|
|
iptables -A DOCKER-USER -s 100.64.0.0/10 -j RETURN
|
|
iptables -A DOCKER-USER -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
|
|
iptables -A DOCKER-USER -i eth0 -j DROP
|
|
iptables -A DOCKER-USER -j RETURN
|
|
|
|
if ip6tables -L DOCKER-USER -n >/dev/null 2>&1; then
|
|
ip6tables -F DOCKER-USER
|
|
ip6tables -A DOCKER-USER -s fd7a:115c:a1e0::/48 -j RETURN
|
|
ip6tables -A DOCKER-USER -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
|
|
ip6tables -A DOCKER-USER -i eth0 -j DROP
|
|
ip6tables -A DOCKER-USER -j RETURN
|
|
fi
|
|
exit 0
|