tomasz-syn-grzegorza
359afb3a59
Infrastructure configs for GMKtec K11 (Docker, vLLM, LocalAI, ComfyUI, control-plane, gpu-fan agent, Server UI with CLI/file explorer/GPU fan curve). Co-authored-by: Cursor <cursoragent@cursor.com>
46 lines
1.1 KiB
Bash
Executable File
46 lines
1.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# UFW rules for NPMPlus + LocalAI hardening. Run: sudo ./scripts/configure-firewall.sh
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
|
|
if [[ "${EUID}" -ne 0 ]]; then
|
|
echo "Run as root: sudo ${SCRIPT_DIR}/configure-firewall.sh"
|
|
exit 1
|
|
fi
|
|
|
|
LAN_CIDR="${LAN_CIDR:-192.168.100.0/24}"
|
|
|
|
echo "=== NPMPlus firewall (ufw) ==="
|
|
echo "LAN CIDR for admin port 81: ${LAN_CIDR}"
|
|
echo ""
|
|
|
|
if ! command -v ufw &>/dev/null; then
|
|
echo "Installing ufw..."
|
|
apt-get update -qq && apt-get install -y ufw
|
|
fi
|
|
|
|
ufw default deny incoming
|
|
ufw default allow outgoing
|
|
|
|
ufw allow 22/tcp comment 'SSH'
|
|
ufw allow 80/tcp comment 'NPMPlus HTTP / ACME'
|
|
ufw allow 443/tcp comment 'NPMPlus HTTPS'
|
|
ufw allow 443/udp comment 'NPMPlus HTTP/3'
|
|
ufw allow from "${LAN_CIDR}" to any port 81 proto tcp comment 'NPMPlus admin LAN only'
|
|
|
|
ufw deny 8070/tcp comment 'LocalAI localhost only'
|
|
ufw deny 8090/tcp comment 'gpu-fan not public'
|
|
|
|
echo ""
|
|
echo "Rules to apply:"
|
|
ufw show added || true
|
|
echo ""
|
|
|
|
ufw --force enable
|
|
ufw status verbose
|
|
|
|
echo ""
|
|
echo "Done. Admin UI: https://<LAN-IP>:81 (from ${LAN_CIDR} only)"
|
|
echo "Public HTTPS: ports 80/443"
|