Production hardening: host-aware install, ownership contracts, firewall safety

2026-04-30 03:26:14 +05:00
parent 0545990968
commit c10ab1fafd
25 changed files with 190 additions and 262 deletions
@@ -2,7 +2,7 @@
 # Файл создаётся оркестратором после первичной установки и не является runtime-конфигом.

 DEPLOY_TARGET_OS=debian12
-DEPLOY_TIMESTAMP={{INSTALL_DATE}}
+DEPLOY_TIMESTAMP={{LAST_APPLY_DATE}}
 PACKAGE_NAME=hy2xs-install-package
 PACKAGE_BUILD_ID={{PACKAGE_BUILD_ID}}
 PACKAGE_VERSION={{PACKAGE_VERSION}}
@@ -7,7 +7,6 @@ table ip hy2xs {
    tcp dport {{SSH_PORT}} accept
    {{ACME_RULE}}
    udp dport {{HYSTERIA_PORT}} accept
-    tcp dport {{UI_PORT}} ip saddr {{UI_BIND_HOST}} accept
    icmp type echo-request accept
  }
 }