Initial import: bare-metal stacks, Server UI, GPU fan, tutorials.

Infrastructure configs for GMKtec K11 (Docker, vLLM, LocalAI, ComfyUI, control-plane, gpu-fan agent, Server UI with CLI/file explorer/GPU fan curve). Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-05 12:02:04 +00:00
commit 359afb3a59
153 changed files with 18169 additions and 0 deletions
@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# UFW rules for NPMPlus + LocalAI hardening. Run: sudo ./scripts/configure-firewall.sh
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+if [[ "${EUID}" -ne 0 ]]; then
+  echo "Run as root: sudo ${SCRIPT_DIR}/configure-firewall.sh"
+  exit 1
+fi
+
+LAN_CIDR="${LAN_CIDR:-192.168.100.0/24}"
+
+echo "=== NPMPlus firewall (ufw) ==="
+echo "LAN CIDR for admin port 81: ${LAN_CIDR}"
+echo ""
+
+if ! command -v ufw &>/dev/null; then
+  echo "Installing ufw..."
+  apt-get update -qq && apt-get install -y ufw
+fi
+
+ufw default deny incoming
+ufw default allow outgoing
+
+ufw allow 22/tcp comment 'SSH'
+ufw allow 80/tcp comment 'NPMPlus HTTP / ACME'
+ufw allow 443/tcp comment 'NPMPlus HTTPS'
+ufw allow 443/udp comment 'NPMPlus HTTP/3'
+ufw allow from "${LAN_CIDR}" to any port 81 proto tcp comment 'NPMPlus admin LAN only'
+
+ufw deny 8070/tcp comment 'LocalAI localhost only'
+ufw deny 8090/tcp comment 'gpu-fan not public'
+
+echo ""
+echo "Rules to apply:"
+ufw show added || true
+echo ""
+
+ufw --force enable
+ufw status verbose
+
+echo ""
+echo "Done. Admin UI: https://<LAN-IP>:81 (from ${LAN_CIDR} only)"
+echo "Public HTTPS: ports 80/443"