From effb0662d1f7d5b34cead228446d9d7b35311be0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=D0=92=D0=B8=D0=BA=D1=82=D0=BE=D1=80?=
 <78488229+viktor138irk@users.noreply.github.com>
Date: Sat, 9 May 2026 15:33:13 +0900
Subject: [PATCH] =?UTF-8?q?=D0=94=D0=BE=D0=B1=D0=B0=D0=B2=D0=BB=D0=B5?=
 =?UTF-8?q?=D0=BD=20firewall-=D1=81=D0=BA=D1=80=D0=B8=D0=BF=D1=82=20=D0=B4?=
 =?UTF-8?q?=D0=BB=D1=8F=20private=20proxy=20Matrix?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 scripts/firewall_private_proxy.sh | 59 +++++++++++++++++++++++++++++++
 1 file changed, 59 insertions(+)
 create mode 100644 scripts/firewall_private_proxy.sh

diff --git a/scripts/firewall_private_proxy.sh b/scripts/firewall_private_proxy.sh
new file mode 100644
index 0000000..342dd1b
--- /dev/null
+++ b/scripts/firewall_private_proxy.sh
@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+
+FASTPANEL_PROXY_IP="${FASTPANEL_PROXY_IP:-192.168.0.221}"
+MATRIX_PORT="${MATRIX_PORT:-8008}"
+ALLOW_SSH="${ALLOW_SSH:-yes}"
+SSH_PORT="${SSH_PORT:-22}"
+APPLY_UFW_DEFAULTS="${APPLY_UFW_DEFAULTS:-no}"
+
+log() { echo "[INFO] $*"; }
+warn() { echo "[WARN] $*"; }
+fail() { echo "[ERROR] $*" >&2; exit 1; }
+
+need_root() {
+    if [ "$(id -u)" -ne 0 ]; then
+        fail "Run as root: sudo FASTPANEL_PROXY_IP=$FASTPANEL_PROXY_IP bash scripts/firewall_private_proxy.sh"
+    fi
+}
+
+need_command() {
+    command -v "$1" >/dev/null 2>&1 || fail "Required command not found: $1"
+}
+
+main() {
+    need_root
+    need_command ufw
+
+    log "Configuring UFW for Matrix private reverse proxy"
+    echo "  FastPanel proxy IP: $FASTPANEL_PROXY_IP"
+    echo "  Matrix port:        $MATRIX_PORT"
+
+    if [ "$ALLOW_SSH" = "yes" ]; then
+        ufw allow "$SSH_PORT"/tcp comment 'allow SSH'
+    else
+        warn "ALLOW_SSH is not yes, SSH rule was not added"
+    fi
+
+    ufw allow from "$FASTPANEL_PROXY_IP" to any port "$MATRIX_PORT" proto tcp comment 'Pulse Matrix from FastPanel proxy'
+    ufw deny "$MATRIX_PORT"/tcp comment 'deny public Matrix direct access'
+
+    if [ "$APPLY_UFW_DEFAULTS" = "yes" ]; then
+        ufw default deny incoming
+        ufw default allow outgoing
+    else
+        warn "UFW default policy not changed. Set APPLY_UFW_DEFAULTS=yes if this is a clean Core server."
+    fi
+
+    ufw --force enable
+
+    echo
+    log "Current UFW status"
+    ufw status numbered
+
+    echo
+    log "Done. Verify from FastPanel proxy: curl http://<CORE_PRIVATE_IP>:$MATRIX_PORT/_matrix/client/versions"
+}
+
+main "$@"