30 lines
1.4 KiB
Bash
Executable File
30 lines
1.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
[[ $EUID == 0 ]] || { echo 'Run with sudo.' >&2; exit 1; }
|
|
cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.."
|
|
command -v iptables >/dev/null
|
|
python3 - <<'PY'
|
|
import ipaddress,json,subprocess
|
|
from pathlib import Path
|
|
values = {}
|
|
for line in Path('.env').read_text().splitlines():
|
|
key, sep, value = line.partition('=')
|
|
if sep and key in ('BIND_ADDRESS','WORKSTATION_IP'):
|
|
values[key] = str(ipaddress.IPv4Address(value))
|
|
lan, workstation = values['BIND_ADDRESS'], values['WORKSTATION_IP']
|
|
interfaces = json.loads(subprocess.check_output(['ip','-j','-4','address','show']))
|
|
if lan not in [a.get('local') for i in interfaces for a in i.get('addr_info',[])]:
|
|
raise SystemExit('BIND_ADDRESS is not assigned to this VM.')
|
|
if ipaddress.ip_address(lan).is_unspecified or ipaddress.ip_address(lan).is_loopback:
|
|
raise SystemExit('Use the actual VM LAN address.')
|
|
p=Path('/etc/host-metrics-access.conf')
|
|
p.write_text(f'VM_LAN_IP={lan}\nWORKSTATION_IP={workstation}\n');p.chmod(0o600)
|
|
print(f'Restricting the metrics service ports on {lan} to workstation {workstation}.')
|
|
PY
|
|
install -m 0755 configs/network/access-rules.sh /usr/local/sbin/host-metrics-access
|
|
install -m 0644 configs/network/host-metrics-access.service /etc/systemd/system/host-metrics-access.service
|
|
systemctl daemon-reload
|
|
systemctl enable host-metrics-access.service
|
|
systemctl restart host-metrics-access.service
|
|
iptables -w 5 -S HOST-METRICS-ACCESS
|