YANG JIANKUAN
5326c572a2
迁入通用节点部署工具、离线交付页生成器和共用技能，隔离真实配置与交付产物。统一 Codex 与 Claude Code 开发约定，补充节点迁移与运维文档。 完善 FINAL、策略组引用、输入校验、Surge 字段编码与 AI DNS 例外保护，增加隔离测试和订阅验证工具。 验证：全量类型检查、44 项单测、前端构建、脚本语法、技能入口与凭据隔离检查均通过。
19 lines
935 B
Bash
Executable File
19 lines
935 B
Bash
Executable File
#!/usr/bin/env bash
|
|
# Firewall for a node that runs BOTH planes:
|
|
# * TCP 22/80/443 — ssh + nginx (the six WS inbounds and the 3x-ui panel are all
|
|
# 127.0.0.1-only and reach the world only through nginx:443).
|
|
# * UDP x4 — Hysteria2 / TUIC terminate QUIC themselves, so unlike the TCP
|
|
# inbounds they need genuinely public UDP ports. UDP 443 (hy2-direct) coexists
|
|
# with nginx's TCP 443: different protocol, different socket.
|
|
# RackNerd KVM has no provider-side firewall, so ufw is the only gate here.
|
|
. "$(dirname "$0")/_lib.sh"
|
|
|
|
require_vars PORT_HY2_DIRECT PORT_HY2_WARP PORT_TUIC_DIRECT PORT_TUIC_WARP
|
|
|
|
run "for p in 22 80 443; do ufw allow \$p/tcp >/dev/null 2>&1; done
|
|
for p in $PORT_HY2_DIRECT $PORT_HY2_WARP $PORT_TUIC_DIRECT $PORT_TUIC_WARP; do
|
|
ufw allow \$p/udp >/dev/null 2>&1
|
|
done
|
|
yes | ufw enable >/dev/null 2>&1 || true
|
|
ufw status verbose | grep -E 'Status|/tcp|/udp'"
|