From 63808ccd20e1e6bc2401eb4280d9fd466146d68f Mon Sep 17 00:00:00 2001 From: dev_agent Date: Mon, 5 Oct 2026 17:35:39 -0400 Subject: [PATCH] Add MealQuest host firewall unit for port 8090 Restrict the published MealQuest port 8090 in DOCKER-USER to Traefik (10.60.1.33) and the Docker host (10.60.1.14), dropping all other sources. DOCKER-USER sees post-DNAT traffic, so rules match the original destination port with conntrack rather than --dport. A docker.service drop-in re-applies the rules after every docker restart. Co-Authored-By: Claude Opus 5.5 --- .../docker.service.d/mealquest-firewall.conf | 3 +++ deploy/systemd/mealquest-firewall.service | 12 +++++++++++ deploy/systemd/mealquest-firewall.sh | 21 +++++++++++++++++++ 3 files changed, 36 insertions(+) create mode 100644 deploy/systemd/docker.service.d/mealquest-firewall.conf create mode 100644 deploy/systemd/mealquest-firewall.service create mode 100755 deploy/systemd/mealquest-firewall.sh diff --git a/deploy/systemd/docker.service.d/mealquest-firewall.conf b/deploy/systemd/docker.service.d/mealquest-firewall.conf new file mode 100644 index 0000000..afe3355 --- /dev/null +++ b/deploy/systemd/docker.service.d/mealquest-firewall.conf @@ -0,0 +1,3 @@ +# Re-apply the MealQuest DOCKER-USER rules after every docker (re)start. +[Service] +ExecStartPost=/usr/local/sbin/mealquest-firewall diff --git a/deploy/systemd/mealquest-firewall.service b/deploy/systemd/mealquest-firewall.service new file mode 100644 index 0000000..fd98254 --- /dev/null +++ b/deploy/systemd/mealquest-firewall.service @@ -0,0 +1,12 @@ +[Unit] +Description=Restrict MealQuest port 8090 to Traefik (DOCKER-USER) +After=docker.service +Requires=docker.service + +[Service] +Type=oneshot +RemainAfterExit=yes +ExecStart=/usr/local/sbin/mealquest-firewall + +[Install] +WantedBy=multi-user.target diff --git a/deploy/systemd/mealquest-firewall.sh b/deploy/systemd/mealquest-firewall.sh new file mode 100755 index 0000000..ca0ff66 --- /dev/null +++ b/deploy/systemd/mealquest-firewall.sh @@ -0,0 +1,21 @@ +#!/bin/sh +# Restrict the MealQuest published host port to Traefik (10.60.1.33) and the +# Docker host itself (10.60.1.14); drop every other source. +# +# DOCKER-USER runs after Docker's DNAT, so the destination port there is the +# container port (8080), not the published one. Match the original +# destination port with conntrack instead of --dport. +# +# Idempotent: each rule is checked (-C) before it is added, so re-runs add +# nothing. Installed as /usr/local/sbin/mealquest-firewall. +set -eu + +port=8090 +match="-p tcp -m conntrack --ctorigdstport $port --ctdir ORIGINAL" + +iptables -C DOCKER-USER -s 10.60.1.33/32 $match -j RETURN 2>/dev/null || + iptables -I DOCKER-USER 1 -s 10.60.1.33/32 $match -j RETURN +iptables -C DOCKER-USER -s 10.60.1.14/32 $match -j RETURN 2>/dev/null || + iptables -I DOCKER-USER 2 -s 10.60.1.14/32 $match -j RETURN +iptables -C DOCKER-USER $match -j DROP 2>/dev/null || + iptables -A DOCKER-USER $match -j DROP