zizi-al/sub2api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
sub2api/ops/remote/us-racknerd-0526-sub2api/current/firewall-notes.md
zizi 6814fa2a62 docs(ops): record proxy-ng deployment hardening 
Add deployment traces for the JPpro proxy node, RackNerd origin hosts, catproxy boundary changes, local speed checks, and Sub2API rate-limit behavior.

Keep remote secrets excluded while tracking sanitized nginx, compose, plan, and operational memory documents.
2026-05-26 23:27:41 +08:00

1.1 KiB
Raw Permalink Blame History

3c4g firewall and origin boundary notes

日期：2026-05-26

  • origin.proxy.api.lilifamily.com: nginx allowlist only permits JPpro 151.242.164.72.
  • origin.proxy.api.lilifamily.com: X-Proxy-Ng-Token is required and redacted from Git.
  • catproxy.lilifamily.com: public direct main-site entry on 3c4g; no nginx IP allowlist is applied.
  • proxy.api.lilifamily.com: DNS points to JPpro 151.242.164.72; 3c4g old sub2api.conf site is disabled from sites-enabled.
  • 127.0.0.1:8080: Sub2API local upstream only; Docker publishes it on loopback, not public interfaces.
  • Default unknown Host behavior: nginx 00-default-deny.conf returns 444 for unknown HTTP/HTTPS hosts.
  • logrotate: /etc/logrotate.d/nginx-proxy-ng dry-run succeeded.
  • Validation: local/public origin without token returned 403; JPpro with token returned 200; catproxy.lilifamily.com/health returned 200; direct 3c4g proxy.api SNI no longer serves the application.

Known limitation: origin enforcement is nginx-layer allow/deny, not a system firewall rule. If future origin is moved to a dedicated port, also add nftables/cloud firewall rules for proxy-ng node IPs only.