27 lines
1.2 KiB
Bash
Executable File
27 lines
1.2 KiB
Bash
Executable File
#!/bin/bash
|
|
# Жёстко закрыть 38001-38004 на вулнбоксе + пересобрать rusgram.
|
|
# Docker публикует порты МИМО цепочки INPUT — поэтому DOCKER-USER обязателен.
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")"
|
|
|
|
echo "[*] rebuild + up"
|
|
docker compose down --remove-orphans || true
|
|
docker compose up -d --build --force-recreate
|
|
|
|
echo "[*] firewall: DROP 38001-38004 (INPUT + DOCKER-USER)"
|
|
for chain in INPUT DOCKER-USER; do
|
|
# идемпотентно: сначала снести старые наши правила, потом поставить
|
|
while iptables -C "$chain" -p tcp --dport 38001:38004 -j DROP 2>/dev/null; do
|
|
iptables -D "$chain" -p tcp --dport 38001:38004 -j DROP || true
|
|
done
|
|
iptables -I "$chain" -p tcp --dport 38001:38004 -j DROP
|
|
done
|
|
|
|
echo "[*] published ports now:"
|
|
docker compose ps
|
|
ss -ltn | grep -E '3800[0-4]' || echo "(нет слушателей 38001-38004 — ок)"
|
|
|
|
echo "[*] self-check: :38002 снаружи должен быть мёртв"
|
|
echo " curl -s -m 2 http://127.0.0.1:38002/images/1 → connection refused"
|
|
echo " curl -s -m 2 http://127.0.0.1:38000/login.html → 200"
|