Tizian 「ティツィアーン」
29844c7fa6
ramiel's HAProxy passes halkyon.li's TLS connections, unopened, through a WireGuard tunnel to the instance at home, with the visitor's address in a PROXY header, and everything else to ramiel's own Caddy, moved to the loopback. Each end's nftables table lets the tunnel carry HAProxy's 443 and the SSH jump's 22 alone, and nothing from home to ramiel. The host at home: sshd with keys alone, the root disk unlocked over SSH at boot (dropbear-initramfs, D20), Docker's and containerd's data bind-mounted from the HDD, and home's end of the tunnel before Docker. An instance behind the forward (compose.forwarded.yaml) publishes 443 on the tunnel's address alone, trusts the PROXY header from ramiel alone, and gets its certificates through TLS-ALPN, without HTTP/3. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
45 lines
1.8 KiB
Text
45 lines
1.8 KiB
Text
# The rules around home's end of the tunnel from ramiel (ADR 0039, D9, D17), loaded by
|
|
# wg-quick as the tunnel comes up and deleted as it goes (wg-halkyon.conf), so they live
|
|
# exactly as long as it. As /etc/wireguard/wg-halkyon.nft on the instance's host at home
|
|
# (root, 0600).
|
|
#
|
|
# A table of its own, apart from Docker's and ufw's, at a priority before theirs: what it
|
|
# drops is dropped whatever they say, and what it accepts still meets their rules after
|
|
# it.
|
|
#
|
|
# - To the host: new connections from ramiel to sshd alone (22, the jump from away),
|
|
# then replies.
|
|
# - Through the host: new connections from ramiel to Caddy's 443 alone (172.30.80.2 on
|
|
# edge, where Docker has sent the tunnel address's 443 by then), then replies;
|
|
# nothing to the home network, the other containers or anywhere else.
|
|
# - Towards ramiel: replies alone.
|
|
#
|
|
# IPv4 alone: the tunnel carries no IPv6 (D8).
|
|
|
|
# Made and deleted first, so loading this again replaces it whole.
|
|
table inet halkyon_tunnel {}
|
|
delete table inet halkyon_tunnel
|
|
|
|
table inet halkyon_tunnel {
|
|
chain input {
|
|
type filter hook input priority filter - 1; policy accept;
|
|
iifname "wg-halkyon" ct state established,related accept
|
|
iifname "wg-halkyon" ip saddr 10.61.97.1 tcp dport 22 accept
|
|
iifname "wg-halkyon" drop
|
|
}
|
|
|
|
chain forward {
|
|
type filter hook forward priority filter - 1; policy accept;
|
|
iifname "wg-halkyon" ct state established,related accept
|
|
iifname "wg-halkyon" ip saddr 10.61.97.1 ip daddr 172.30.80.2 tcp dport 443 accept
|
|
iifname "wg-halkyon" drop
|
|
oifname "wg-halkyon" ct state established,related accept
|
|
oifname "wg-halkyon" drop
|
|
}
|
|
|
|
chain output {
|
|
type filter hook output priority filter - 1; policy accept;
|
|
oifname "wg-halkyon" ct state established,related accept
|
|
oifname "wg-halkyon" drop
|
|
}
|
|
}
|