streamline package naming

2026-07-29 13:07:34 +02:00
parent 1ba1c2a32a
commit 7e703c93b1
100 changed files with 141 additions and 139 deletions
@@ -0,0 +1,77 @@
+# armor-ufw
+
+**Activate UFW (Uncomplicated Firewall)**
+
+## Purpose
+
+This cube configures and enables UFW, a user-friendly firewall management tool for Linux systems, providing basic protection against unauthorized network access.
+
+## What is UFW?
+
+UFW (Uncomplicated Firewall) is a frontend for `iptables` designed to make firewall configuration simple and accessible. It provides:
+
+- **Easy-to-understand syntax**: Commands like `ufw allow ssh` instead of complex iptables rules
+- **Default deny policy**: Blocks all incoming connections except those explicitly allowed
+- **Connection tracking**: Automatically handles related and established connections
+- **Application profiles**: Pre-configured rules for common services
+
+Think of UFW as a security gate for your server - it controls which network traffic is allowed in and out.
+
+## What This Cube Does
+
+1. Configures UFW to allow SSH connections (port 22)
+   - Ensures you don't lock yourself out when enabling the firewall
+2. Optionally allows HTTP traffic (port 80) based on the `ALLOW_HTTP` parameter
+3. Enables the firewall with the configured rules
+
+## Configuration
+
+### Parameters
+
+- **ALLOW_HTTP** (boolean, default: `true`)
+  - Allow incoming HTTP traffic on port 80
+  - Set to `false` if you're only using HTTPS or don't need web traffic
+
+## Dependencies
+
+- **apt:essentials** - Required for basic system tools
+
+## Security Notes
+
+**Important**: This cube automatically allows SSH to prevent lockouts. If you need to allow additional services, you can run:
+
+```bash
+sudo ufw allow [port number]/[protocol]
+sudo ufw allow [service-name]
+```
+
+Examples:
+- `sudo ufw allow 443/tcp` - Allow HTTPS
+- `sudo ufw allow 3000/tcp` - Allow custom application port
+- `sudo ufw allow https` - Allow HTTPS by service name
+
+## Post-Installation
+
+Check firewall status:
+```bash
+sudo ufw status verbose
+sudo ufw status numbered
+```
+
+Common UFW commands:
+- Delete rule: `sudo ufw delete [rule number]`
+- Disable firewall: `sudo ufw disable`
+- Reset to defaults: `sudo ufw reset`
+
+## UFW File Locations
+
+UFW rules are stored in the `/etc/ufw` directory:
+
+- `/etc/ufw/user.rules` - Custom rules added via the `ufw` command
+- `/etc/ufw/before.rules` - Rules processed before user rules (high priority)
+- `/etc/ufw/after.rules` - Rules processed after user rules (exceptions)
+- `/etc/ufw/sysctl.conf` - Kernel network parameters (e.g., packet forwarding)
+- `/etc/ufw/applications.d/` - Application profiles for common services
+- `/etc/default/ufw` - Global UFW settings and default policies
+
+Understanding these locations is helpful for troubleshooting, manual edits, or backing up your firewall configuration.
@@ -0,0 +1,13 @@
+from pyinfra.operations import server
+from pyinfra import host
+
+ALLOW_HTTP=host.data.ALLOW_HTTP
+
+server.shell(
+    commands=[
+        f"ufw allow ssh",
+        f"ufw allow http" if ALLOW_HTTP else "",
+        f"ufw enable",
+    ],
+    _sudo=True
+)
@@ -0,0 +1,11 @@
+import { Manifest } from '@bitsquare/nopy-cubes';
+import { z } from 'zod';
+
+export default Manifest({
+  id: 'armor:ufw',
+  name: 'Activate ufw (uncomplicated firewall)',
+  dependencies: () => ['apt:essentials'],
+  schema: z.object({
+    ALLOW_HTTP: z.boolean().describe('Allow incoming HTTP traffic on port 80').default(true),
+  }),
+});