mirror of
https://github.com/RWejlgaard/pez-infra.git
synced 2026-07-04 15:46:16 +00:00
Rasmus "Pez" Wejlgaard
3871dc8f90
Samba on london-b was allowed on 445/tcp from anywhere via UFW, exposing SMB/CIFS to the public internet. Tailscale already reaches it through the tailscale0 allow-all rule, so scope the explicit rule to the local London LAN (192.168.1.0/24) instead of the world. The common UFW task only ever adds allow rules, so it gained support for an optional per-port from_ip, plus a follow-up task that deletes the superseded world-open variant of any source-restricted port — otherwise the old '445 ALLOW Anywhere' rule would linger on the host and defeat the change. PESO-145 |
||
|---|---|---|
| .. | ||
| copenhagen-a.yml | ||
| copenhagen-c.yml | ||
| helsinki-a.yml | ||
| london-a.yml | ||
| london-b.yml | ||
| london-c.yml | ||
| nuremberg-a.yml | ||