overseerandClaude Opus 5.5
21a8365c6a
F17-001: commit the API box's nestquest-api-firewall.service verbatim as deploy/systemd/nestquest-api-firewall.service (DOCKER-USER RETURN for 10.60.1.33 and 10.60.1.14, then DROP tcp/8080) and make the runbook install it from the repository before exposing the API. F17-002: pin the python:3.12-slim base image by digest in both build stages, pin api/requirements.txt to the exact versions installed in the deployed image (direct deps plus transitive closure), and pin the litestream image by digest in deploy/compose.yaml. Task: e4a7b18b-5dad-4387-90ac-33588c280824 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
13 lines
660 B
Desktop File
13 lines
660 B
Desktop File
[Unit]
|
|
Description=Restrict NestQuest API port 8080 to Traefik (DOCKER-USER)
|
|
After=docker.service
|
|
Requires=docker.service
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
RemainAfterExit=yes
|
|
ExecStart=/bin/sh -c "iptables -C DOCKER-USER -s 10.60.1.33/32 -p tcp --dport 8080 -j RETURN 2>/dev/null || iptables -I DOCKER-USER 1 -s 10.60.1.33 -p tcp --dport 8080 -j RETURN; iptables -C DOCKER-USER -s 10.60.1.14/32 -p tcp --dport 8080 -j RETURN 2>/dev/null || iptables -I DOCKER-USER 2 -s 10.60.1.14 -p tcp --dport 8080 -j RETURN; iptables -C DOCKER-USER -p tcp --dport 8080 -j DROP 2>/dev/null || iptables -A DOCKER-USER -p tcp --dport 8080 -j DROP"
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|