profit/llm-team-ui
1
0
Fork 0
Code Issues Pull Requests 3 Actions Packages Projects Releases Wiki Activity

Add server security configs and setup script

Browse Source 
- Nginx configs with security headers (X-Frame-Options, CSP, etc.)
- fail2ban jails for nginx (botsearch, bad-request, forbidden)
- Kernel hardening via sysctl (rp_filter, no redirects, log martians)
- SSH hardening (no root, max 3 attempts, no X11)
- UFW rules export
- Idempotent setup.sh to restore all configs on fresh install
- Flask bound to 127.0.0.1 (nginx-only access)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
root
2026-03-25 04:47:54 -05:00
co-authored by Claude Opus 4.6
parent 0d00ced622
commit 6ea457d01d
9 changed files with 365 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/ufw-rules.txt
+24
View File
@@ -0,0 +1,24 @@
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), deny (routed)
New profiles: skip
To Action From
-- ------ ----
22/tcp ALLOW IN Anywhere
139,445/tcp ALLOW IN 192.168.1.0/24
137,138/udp ALLOW IN 192.168.1.0/24
3030/tcp ALLOW IN Anywhere
11434 ALLOW IN 192.168.1.0/24 # Ollama internal
18789 ALLOW IN 192.168.1.0/24 # OpenClaw brain
80/tcp ALLOW IN Anywhere # HTTP web server
443/tcp ALLOW IN Anywhere # HTTPS web server
5000 ALLOW IN 192.168.1.0/24 # LLM Team UI
9000 ALLOW IN 192.168.1.0/24 # MinIO LAN only
9000 DENY IN Anywhere # Block MinIO external
22/tcp (v6) ALLOW IN Anywhere (v6)
3030/tcp (v6) ALLOW IN Anywhere (v6)
80/tcp (v6) ALLOW IN Anywhere (v6) # HTTP web server
443/tcp (v6) ALLOW IN Anywhere (v6) # HTTPS web server
9000 (v6) DENY IN Anywhere (v6) # Block MinIO external