wip #7023 @2

diff --git a/app/Models/TeamServers.php b/app/Models/TeamServers.php
index c8d4dbaa0eba804c4d9df5148b40ef4d8c5ee810..bbe91373917839b25a9fbf4bffe6392ea74d7cb5 100644 (file)
--- a/app/Models/TeamServers.php
+++ b/app/Models/TeamServers.php
@@ -38,7 +38,7 @@ class TeamServers extends CubistMagicAbstractModel
         $clients = Text::explodeNewLines($this->clients);
         $ip = Text::explodeNewLines($this->ip);
         $forceContainers = Text::explodeNewLines($this->docker);
-        $excludeContainers = array_merge(['portainer'], Text::explodeNewLines($this->docker_restricted));
+        $excludeContainers = array_merge(['portainer', 'monit'], Text::explodeNewLines($this->docker_restricted));
         $excludeContainers = array_diff($excludeContainers, $forceContainers);
 
         $sshports = [22, 22022, 22822, 22222];
@@ -57,6 +57,8 @@ ufw disable
 ufw default allow outgoing
 
 ';
+            $dhosts = [];
+
             $locals = ['127.0.0.0/8', '10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16'];
             $lhosts = [];
             foreach ($locals as $k => $local) {
@@ -67,6 +69,7 @@ ufw default allow outgoing
 
             foreach ($ip as $k => $i) {
                 $lhosts[] = '$i' . $k;
+                $dhosts[] = '$i' . $k;
                 $fw .= 'i' . $k . '=' . self::digOrIP($i) . "\n";
             }
             $fw .= "\n";
@@ -87,10 +90,12 @@ ufw default allow outgoing
                     continue;
                 }
                 $hosts[] = '$s' . $k;
+                $dhosts[] = '$s' . $k;
                 $fw .= 's' . $k . '=' . self::digOrIP($s['name'] . '.cubedesigners.com') . "\n";
                 $others = Text::explodeNewLines($s['others']);
                 foreach ($others as $kk => $o) {
                     $hosts[] = '$s' . $k . '_' . $kk;
+                    $dhosts[] = '$s' . $k . '_' . $kk;
                     $fw .= 's' . $k . '_' . $kk . '=' . self::digOrIP($o) . "\n";
                 }
             }
@@ -98,6 +103,7 @@ ufw default allow outgoing
 
 
             $fw .= 'auth=(' . implode(' ', $hosts) . ')' . "\n\n";
+            $fw .= 'docker_allowed=(' . implode(' ', $dhosts) . ')' . "\n\n";
 
             if ($server['backup']) {
                 $backup = [];
@@ -108,7 +114,6 @@ ufw default allow outgoing
                 $fw .= 'backup=(' . implode(' ', $backup) . ')' . "\n";
             }
 
-
             $openPorts = Text::trimExplode(',', $server['ports']);
 
             if ($server['dns']) {
@@ -171,12 +176,12 @@ done' . "\n\n";
 
 skip_containers=(';
             foreach ($excludeContainers as $excludeContainer) {
-                $fw.='"'.$excludeContainer.'" ';
+                $fw .= '"' . $excludeContainer . '" ';
             }
 
             $fw .= ')
 
-sudo wget -O /usr/local/bin/ufw-docker https://github.com/chaifeng/ufw-docker/raw/master/ufw-docker
+sudo wget -O /usr/local/bin/ufw-docker https://raw.githubusercontent.com/EnhydraV/ufw-docker/refs/heads/master/ufw-docker
 sudo chmod +x /usr/local/bin/ufw-docker
 # Finally enable firewall
 ufw --force enable
@@ -195,6 +200,11 @@ docker ps --filter publish=1-65535 --filter status=running --format "table {{.Na
 
     if ! $skip; then
         ufw-docker allow "$container"
+    else
+        for ip in "${docker_allowed[@]}"
+        do
+            ufw-docker allow-from "$container" $ip
+        done
     fi
 done
 

diff --git a/resources/servers/amadeus/firewall b/resources/servers/amadeus/firewall
index c94e5cf2d62b4ca89d3ab531df80e3991144cacc..c27ca37735394619c0c9940c599f4a4457cf3163 100644 (file)
--- a/resources/servers/amadeus/firewall
+++ b/resources/servers/amadeus/firewall
@@ -43,6 +43,8 @@ s6=`dig +short fastandfurious.cubedesigners.com | tail -1`
 
 auth=($s1 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s6)
 
+docker_allowed=($i0 $i1 $i2 $i3 $s1 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s6)
+
 
 for ip in "${blacklist[@]}"
 do
@@ -72,9 +74,9 @@ ufw deny out 22822
 ufw deny out 22222
 
 
-skip_containers=("portainer" )
+skip_containers=("portainer" "monit" )
 
-sudo wget -O /usr/local/bin/ufw-docker https://github.com/chaifeng/ufw-docker/raw/master/ufw-docker
+sudo wget -O /usr/local/bin/ufw-docker https://raw.githubusercontent.com/EnhydraV/ufw-docker/refs/heads/master/ufw-docker
 sudo chmod +x /usr/local/bin/ufw-docker
 # Finally enable firewall
 ufw --force enable
@@ -93,6 +95,11 @@ docker ps --filter publish=1-65535 --filter status=running --format "table {{.Na
 
     if ! $skip; then
         ufw-docker allow "$container"
+    else
+        for ip in "${docker_allowed[@]}"
+        do
+            ufw-docker allow-from "$container" $ip
+        done
     fi
 done
 

diff --git a/resources/servers/benhur/firewall b/resources/servers/benhur/firewall
index c97c03fa030d7c3bb2fe418c0a6856d1e2c6b7cb..0cec4646ca70824d3f7e9aaf1b7bec14b51a2001 100644 (file)
--- a/resources/servers/benhur/firewall
+++ b/resources/servers/benhur/firewall
@@ -44,6 +44,8 @@ s6=`dig +short fastandfurious.cubedesigners.com | tail -1`
 
 auth=($s0 $s0_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s6)
 
+docker_allowed=($i0 $i1 $i2 $i3 $s0 $s0_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s6)
+
 
 for ip in "${blacklist[@]}"
 do
@@ -73,9 +75,9 @@ ufw deny out 22822
 ufw deny out 22222
 
 
-skip_containers=("portainer" )
+skip_containers=("portainer" "monit" )
 
-sudo wget -O /usr/local/bin/ufw-docker https://github.com/chaifeng/ufw-docker/raw/master/ufw-docker
+sudo wget -O /usr/local/bin/ufw-docker https://raw.githubusercontent.com/EnhydraV/ufw-docker/refs/heads/master/ufw-docker
 sudo chmod +x /usr/local/bin/ufw-docker
 # Finally enable firewall
 ufw --force enable
@@ -94,6 +96,11 @@ docker ps --filter publish=1-65535 --filter status=running --format "table {{.Na
 
     if ! $skip; then
         ufw-docker allow "$container"
+    else
+        for ip in "${docker_allowed[@]}"
+        do
+            ufw-docker allow-from "$container" $ip
+        done
     fi
 done
 

diff --git a/resources/servers/cloudatlas/firewall b/resources/servers/cloudatlas/firewall
index f4ebfc97d7cbb54c61787cb66c5dd26548662418..e1759db040e6084fee9fcc46ae228f99c3668928 100644 (file)
--- a/resources/servers/cloudatlas/firewall
+++ b/resources/servers/cloudatlas/firewall
@@ -36,6 +36,8 @@ s6=`dig +short fastandfurious.cubedesigners.com | tail -1`
 
 auth=($s0 $s0_0 $s1 $s3 $s4 $s5 $s6)
 
+docker_allowed=($i0 $i1 $i2 $i3 $s0 $s0_0 $s1 $s3 $s4 $s5 $s6)
+
 
 for ip in "${blacklist[@]}"
 do
@@ -65,9 +67,9 @@ ufw deny out 22822
 ufw deny out 22222
 
 
-skip_containers=("portainer" )
+skip_containers=("portainer" "monit" )
 
-sudo wget -O /usr/local/bin/ufw-docker https://github.com/chaifeng/ufw-docker/raw/master/ufw-docker
+sudo wget -O /usr/local/bin/ufw-docker https://raw.githubusercontent.com/EnhydraV/ufw-docker/refs/heads/master/ufw-docker
 sudo chmod +x /usr/local/bin/ufw-docker
 # Finally enable firewall
 ufw --force enable
@@ -86,6 +88,11 @@ docker ps --filter publish=1-65535 --filter status=running --format "table {{.Na
 
     if ! $skip; then
         ufw-docker allow "$container"
+    else
+        for ip in "${docker_allowed[@]}"
+        do
+            ufw-docker allow-from "$container" $ip
+        done
     fi
 done
 

diff --git a/resources/servers/dobermann/firewall b/resources/servers/dobermann/firewall
index 891e8fc9e50f6a86667b12e8e2ffae4c580e1b5e..185d7be6d3414a07b740a07d29730e57340e03b4 100644 (file)
--- a/resources/servers/dobermann/firewall
+++ b/resources/servers/dobermann/firewall
@@ -44,6 +44,8 @@ s6=`dig +short fastandfurious.cubedesigners.com | tail -1`
 
 auth=($s0 $s0_0 $s1 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s4 $s5 $s6)
 
+docker_allowed=($i0 $i1 $i2 $i3 $s0 $s0_0 $s1 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s4 $s5 $s6)
+
 c0=`dig +short www.fondation-sycomore.com | tail -1`
 backup=($c0)
 ufw allow 53
@@ -83,9 +85,9 @@ ufw deny out 22822
 ufw deny out 22222
 
 
-skip_containers=("portainer" )
+skip_containers=("portainer" "monit" )
 
-sudo wget -O /usr/local/bin/ufw-docker https://github.com/chaifeng/ufw-docker/raw/master/ufw-docker
+sudo wget -O /usr/local/bin/ufw-docker https://raw.githubusercontent.com/EnhydraV/ufw-docker/refs/heads/master/ufw-docker
 sudo chmod +x /usr/local/bin/ufw-docker
 # Finally enable firewall
 ufw --force enable
@@ -104,6 +106,11 @@ docker ps --filter publish=1-65535 --filter status=running --format "table {{.Na
 
     if ! $skip; then
         ufw-docker allow "$container"
+    else
+        for ip in "${docker_allowed[@]}"
+        do
+            ufw-docker allow-from "$container" $ip
+        done
     fi
 done
 

diff --git a/resources/servers/elephantman/firewall b/resources/servers/elephantman/firewall
index 14cd439db62d6ff76d429b53c135edd14193e8c7..ea40f90404d285266dab882f5287c12aa8af29e3 100644 (file)
--- a/resources/servers/elephantman/firewall
+++ b/resources/servers/elephantman/firewall
@@ -44,6 +44,8 @@ s6=`dig +short fastandfurious.cubedesigners.com | tail -1`
 
 auth=($s0 $s0_0 $s1 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s6)
 
+docker_allowed=($i0 $i1 $i2 $i3 $s0 $s0_0 $s1 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s6)
+
 
 for ip in "${blacklist[@]}"
 do
@@ -78,9 +80,9 @@ ufw deny out 22822
 ufw deny out 22222
 
 
-skip_containers=("portainer" )
+skip_containers=("portainer" "monit" )
 
-sudo wget -O /usr/local/bin/ufw-docker https://github.com/chaifeng/ufw-docker/raw/master/ufw-docker
+sudo wget -O /usr/local/bin/ufw-docker https://raw.githubusercontent.com/EnhydraV/ufw-docker/refs/heads/master/ufw-docker
 sudo chmod +x /usr/local/bin/ufw-docker
 # Finally enable firewall
 ufw --force enable
@@ -99,6 +101,11 @@ docker ps --filter publish=1-65535 --filter status=running --format "table {{.Na
 
     if ! $skip; then
         ufw-docker allow "$container"
+    else
+        for ip in "${docker_allowed[@]}"
+        do
+            ufw-docker allow-from "$container" $ip
+        done
     fi
 done
 

diff --git a/resources/servers/fastandfurious/firewall b/resources/servers/fastandfurious/firewall
index bd363943f4daf1938467196cea83876353d43d6d..15bb0e76fccd0e0f4475a36c873b3f92c61ae2a7 100644 (file)
--- a/resources/servers/fastandfurious/firewall
+++ b/resources/servers/fastandfurious/firewall
@@ -44,6 +44,8 @@ s5=`dig +short elephantman.cubedesigners.com | tail -1`
 
 auth=($s0 $s0_0 $s1 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5)
 
+docker_allowed=($i0 $i1 $i2 $i3 $s0 $s0_0 $s1 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5)
+
 ufw allow 51820
 
 for ip in "${blacklist[@]}"
@@ -79,9 +81,9 @@ ufw deny out 22822
 ufw deny out 22222
 
 
-skip_containers=("portainer" )
+skip_containers=("portainer" "monit" )
 
-sudo wget -O /usr/local/bin/ufw-docker https://github.com/chaifeng/ufw-docker/raw/master/ufw-docker
+sudo wget -O /usr/local/bin/ufw-docker https://raw.githubusercontent.com/EnhydraV/ufw-docker/refs/heads/master/ufw-docker
 sudo chmod +x /usr/local/bin/ufw-docker
 # Finally enable firewall
 ufw --force enable
@@ -100,6 +102,11 @@ docker ps --filter publish=1-65535 --filter status=running --format "table {{.Na
 
     if ! $skip; then
         ufw-docker allow "$container"
+    else
+        for ip in "${docker_allowed[@]}"
+        do
+            ufw-docker allow-from "$container" $ip
+        done
     fi
 done
 

diff --git a/resources/servers/kingkong/firewall b/resources/servers/kingkong/firewall
index 91715c81ee868ec7efed24cef4fd800e1aa41ad4..66dc05b6b9ecd3684a80fac5c7c8f36f4fe2b8aa 100644 (file)
--- a/resources/servers/kingkong/firewall
+++ b/resources/servers/kingkong/firewall
@@ -44,6 +44,8 @@ s6=`dig +short fastandfurious.cubedesigners.com | tail -1`
 
 auth=($s0 $s0_0 $s1 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s5 $s6)
 
+docker_allowed=($i0 $i1 $i2 $i3 $s0 $s0_0 $s1 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s5 $s6)
+
 
 for ip in "${blacklist[@]}"
 do
@@ -78,9 +80,9 @@ ufw deny out 22822
 ufw deny out 22222
 
 
-skip_containers=("portainer" )
+skip_containers=("portainer" "monit" )
 
-sudo wget -O /usr/local/bin/ufw-docker https://github.com/chaifeng/ufw-docker/raw/master/ufw-docker
+sudo wget -O /usr/local/bin/ufw-docker https://raw.githubusercontent.com/EnhydraV/ufw-docker/refs/heads/master/ufw-docker
 sudo chmod +x /usr/local/bin/ufw-docker
 # Finally enable firewall
 ufw --force enable
@@ -99,6 +101,11 @@ docker ps --filter publish=1-65535 --filter status=running --format "table {{.Na
 
     if ! $skip; then
         ufw-docker allow "$container"
+    else
+        for ip in "${docker_allowed[@]}"
+        do
+            ufw-docker allow-from "$container" $ip
+        done
     fi
 done