Charles N Wyble
67c106a3b6
- Move documentation to docs/ directory for better organization - Add bin/ directory for utility scripts - Add lib/ for shared library functions - Update all build scripts to ensure strict Docker compliance - Enhance AGENTS.md with Docker container requirements - Create comprehensive compliance and security documentation - Reorganize test suite with improved structure - Remove obsolete Dockerfile and archive documentation - Add final security compliance report BREAKING CHANGE: Restructured project layout with moved documentation directories 💘 Generated with Crush Assisted-by: GLM-4.6 via Crush <crush@charm.land>
40 lines
997 B
Bash
Executable File
40 lines
997 B
Bash
Executable File
#!/bin/bash
|
|
# Dynamic firewall setup hook
|
|
set -euo pipefail
|
|
|
|
echo "Setting up firewall configuration..."
|
|
|
|
# Load firewall setup functions from proper volume path
|
|
# shellcheck source=/build/src/firewall-setup.sh
|
|
source /build/src/firewall-setup.sh
|
|
|
|
# Install nftables rules (default deny policy)
|
|
cat >/etc/nftables.conf <<'EOF'
|
|
#!/usr/sbin/nft -f
|
|
# Default secure firewall rules for KNEL-Football
|
|
flush ruleset
|
|
|
|
table inet filter {
|
|
chain input {
|
|
type filter hook input priority 0; policy drop
|
|
iif lo accept comment "Accept loopback"
|
|
icmp type echo-request accept comment "Accept ping"
|
|
}
|
|
|
|
chain forward {
|
|
type filter hook forward priority 0; policy drop
|
|
}
|
|
|
|
chain output {
|
|
type filter hook output priority 0; policy drop
|
|
oif lo accept comment "Accept loopback"
|
|
icmp type echo-request accept comment "Allow ping"
|
|
}
|
|
}
|
|
EOF
|
|
|
|
# Enable nftables service
|
|
systemctl enable nftables
|
|
|
|
echo "Firewall setup hook completed."
|