60 строки
1.6 KiB
Bash
60 строки
1.6 KiB
Bash
#!/usr/bin/env bash
|
|
|
|
set -Eeuo pipefail
|
|
|
|
FASTPANEL_PROXY_IP="${FASTPANEL_PROXY_IP:-192.168.0.221}"
|
|
MATRIX_PORT="${MATRIX_PORT:-8008}"
|
|
ALLOW_SSH="${ALLOW_SSH:-yes}"
|
|
SSH_PORT="${SSH_PORT:-22}"
|
|
APPLY_UFW_DEFAULTS="${APPLY_UFW_DEFAULTS:-no}"
|
|
|
|
log() { echo "[INFO] $*"; }
|
|
warn() { echo "[WARN] $*"; }
|
|
fail() { echo "[ERROR] $*" >&2; exit 1; }
|
|
|
|
need_root() {
|
|
if [ "$(id -u)" -ne 0 ]; then
|
|
fail "Run as root: sudo FASTPANEL_PROXY_IP=$FASTPANEL_PROXY_IP bash scripts/firewall_private_proxy.sh"
|
|
fi
|
|
}
|
|
|
|
need_command() {
|
|
command -v "$1" >/dev/null 2>&1 || fail "Required command not found: $1"
|
|
}
|
|
|
|
main() {
|
|
need_root
|
|
need_command ufw
|
|
|
|
log "Configuring UFW for Matrix private reverse proxy"
|
|
echo " FastPanel proxy IP: $FASTPANEL_PROXY_IP"
|
|
echo " Matrix port: $MATRIX_PORT"
|
|
|
|
if [ "$ALLOW_SSH" = "yes" ]; then
|
|
ufw allow "$SSH_PORT"/tcp comment 'allow SSH'
|
|
else
|
|
warn "ALLOW_SSH is not yes, SSH rule was not added"
|
|
fi
|
|
|
|
ufw allow from "$FASTPANEL_PROXY_IP" to any port "$MATRIX_PORT" proto tcp comment 'Pulse Matrix from FastPanel proxy'
|
|
ufw deny "$MATRIX_PORT"/tcp comment 'deny public Matrix direct access'
|
|
|
|
if [ "$APPLY_UFW_DEFAULTS" = "yes" ]; then
|
|
ufw default deny incoming
|
|
ufw default allow outgoing
|
|
else
|
|
warn "UFW default policy not changed. Set APPLY_UFW_DEFAULTS=yes if this is a clean Core server."
|
|
fi
|
|
|
|
ufw --force enable
|
|
|
|
echo
|
|
log "Current UFW status"
|
|
ufw status numbered
|
|
|
|
echo
|
|
log "Done. Verify from FastPanel proxy: curl http://<CORE_PRIVATE_IP>:$MATRIX_PORT/_matrix/client/versions"
|
|
}
|
|
|
|
main "$@"
|
© 2026 StackWorks