mirror of
https://github.com/RWejlgaard/pez-infra.git
synced 2026-07-04 23:56:16 +00:00
Rasmus Wejlgaard
ede9193996
Samba on london-b was allowed on 445/tcp from anywhere via UFW, exposing SMB/CIFS to the public internet. Tailscale already reaches it through the tailscale0 allow-all rule, so scope the explicit rule to the local London LAN (192.168.1.0/24) instead of the world. The common UFW task only ever adds allow rules, so it gained support for an optional per-port from_ip, plus a follow-up task that deletes the superseded world-open variant of any source-restricted port — otherwise the old '445 ALLOW Anywhere' rule would linger on the host and defeat the change. PESO-145 |
||
|---|---|---|
| .. | ||
| backup/tasks | ||
| caddy | ||
| common | ||
| docker | ||
| docker_services/tasks | ||
| dotfiles/tasks | ||
| mariadb | ||
| media_stack | ||
| proxmox_ve | ||
| status_page | ||
| systemd_services | ||
| zfs | ||