|
@@ -0,0 +1,57 @@
|
|
|
|
|
+# Turvalisus — ohmu (2026-09-26)
|
|
|
|
|
+
|
|
|
|
|
+## Rünnakupind
|
|
|
|
|
+- ohmu on **NAT-i taga** (LAN `192.168.68.114`, WAN `84.50.228.95`); **avalikud domeenid**
|
|
|
|
|
+ (`see1.ee`, `odamus.com`, `nuuditalu.ee` jm) → **`188.166.84.16` = edge** (avalik VM), mitte ohmu.
|
|
|
|
|
+- ohmu Caddy kuulab ainult `100.87.1.24:443` (tailnet). **Internetist otsest ligipääsu pole**
|
|
|
|
|
+ (ruuteril pole forwardi — kinnitatud).
|
|
|
|
|
+- Rünnakupind = **LAN (192.168.68.0/24) + Tailscale'i tailnet**.
|
|
|
|
|
+
|
|
|
|
|
+## UFW
|
|
|
|
|
+- Põhimõte: `deny incoming`.
|
|
|
|
|
+- Lubatud: `22/tcp` kõikjalt; `100.64.0.0/10` (tailnet); `192.168.0.0/16` (LAN); `172.18/20.0.0/16` (docker).
|
|
|
|
|
+- **LAN-blokeering host-protsessidele** (Tailscale'ile ja loopbackile jääb alles):
|
|
|
|
|
+ ```bash
|
|
|
|
|
+ ufw insert 1 deny from 192.168.0.0/16 to any port 8070 proto tcp # llama-server
|
|
|
|
|
+ ufw insert 1 deny from 192.168.0.0/16 to any port 8123 proto tcp # Home Assistant
|
|
|
|
|
+ ufw insert 1 deny from 192.168.0.0/16 to any port 11434 proto tcp # ollama
|
|
|
|
|
+ ufw insert 1 deny from 192.168.0.0/16 to any port 18555 proto tcp # go2rtc (HA)
|
|
|
|
|
+ ```
|
|
|
|
|
+- `22000/tcp` (Syncthing) jäetud avatuks (peer-sync).
|
|
|
|
|
+
|
|
|
|
|
+## Docker: pordid loopback + Tailscale
|
|
|
|
|
+Kõik avalikult (`0.0.0.0`) avaldatud Docker-pordid viidud **ainult** `127.0.0.1` + `100.87.1.24`:
|
|
|
|
|
+`tika:9998`, `anythingllm:3002`, `mcp-filesystem-sse:3100` (ainult loopback), `liiklusatlas:8074`,
|
|
|
|
|
+`reranker:8082`, `flaresolverr:8191`, `clickstack:18080/4317/4318`, `clickstack-proxy:8124`,
|
|
|
|
|
+`n8n:5678`, `playwright:3003`, `jupyter:8887`, `openclaw:3978`. Varem juba: postgres:5432, mariadb:3306,
|
|
|
|
|
+open-webui:3010, portainer:8000/9000/9443, clickhouse:8125/9004, nutikodu:8095.
|
|
|
|
|
+**NB:** Docker möödub ufw-st (`DOCKER-USER` tühi) — seetõttu on ainus kaitse sidumine õige liidesega.
|
|
|
|
|
+`mcp-filesystem-sse` on nüüd ainult `127.0.0.1`; opencode MCP URL → `http://127.0.0.1:3100/sse`.
|
|
|
|
|
+
|
|
|
|
|
+## Saladused
|
|
|
|
|
+- Compose'ist `.env`-i (gitignore'tud, chmod 600): `main/.env` (postgres/mariadb/jupyter) ja
|
|
|
|
|
+ `third/n8n/.env` (TS_AUTHKEY, N8N_RUNNERS_AUTH_TOKEN, N8N_ENCRYPTION_KEY).
|
|
|
|
|
+- **Tähelepanu:** saladused jäid **giti ajalukku** (`/opt/docker-compose` auto-commit). Kaaluda
|
|
|
|
|
+ rotatsiooni ja/või ajaloo puhastust.
|
|
|
|
|
+
|
|
|
|
|
+## SSH
|
|
|
|
|
+- `PasswordAuthentication yes` (jäetud teadlikult); root ainult võtmega; **fail2ban aktiivne**.
|
|
|
|
|
+
|
|
|
|
|
+## Muud leiud (teadvustatud)
|
|
|
|
|
+- `portainer`, `dozzle`, `mcp-terminal` omavad `docker.sock`-i (root-ekvivalent) — portainer on tailnet-only.
|
|
|
|
|
+- `cadvisor` privileged; `homeassistant` host-network.
|
|
|
|
|
+- Tailscale: kogu tailnet on ufw-s lubatud; palju seadmeid (sh `tagged-devices`). Soovitus: Tailscale ACL-d.
|
|
|
|
|
+
|
|
|
|
|
+## Varukoopiad & rollback
|
|
|
|
|
+- Baseline: `/home/ardo/security_backup_2026-09-26/`.
|
|
|
|
|
+- Tar: `/media/ardo/merkuur/backup-2026-09-26/` (`liiklusatlas.tgz`, `openclaw.tgz`, `prod.tgz`,
|
|
|
|
|
+ `docker-compose-configs.tgz`).
|
|
|
|
|
+- Rollback: `git -C /opt/docker-compose revert <commit>` + `docker compose up -d` (või tar-i taastamine
|
|
|
|
|
+ mitte-git kaustadele: `/data/docker/liiklusatlas`, `/data/docker/openclaw`).
|
|
|
|
|
+- Muudatused commitites: `6ad290b` (saladused .env), `2d5b876` (Docker-pordid).
|
|
|
|
|
+
|
|
|
|
|
+## Alles / edasi
|
|
|
|
|
+- Salajaste **rotatsioon** (nt kuuhoolduse käigus) — alusta madala riskiga.
|
|
|
|
|
+- UFW `192.168.0.0/16` kitsendamine (kui LAN pole üldse vajalik) — eraldi otsus.
|
|
|
|
|
+- Tailscale ACL-d (väljaspool ohmu).
|
|
|
|
|
+- SSH parool-auth (teadlikult jäetud).
|
ardo