78a071ba02
Add persistent onion key backup and restore, improve startup resilience, and flesh out the major site verticals with richer navigation, search coverage, and operator documentation. Made-with: Cursor
22 lines
778 B
Bash
Executable File
22 lines
778 B
Bash
Executable File
#!/bin/bash
|
|
# Optional firewall for a demo host: clearnet cannot reach Next/nginx loopback fronts.
|
|
# Run once with sudo after SSH access is confirmed. Re-read if your SSH port is not 22.
|
|
#
|
|
# sudo bash scripts/classroom-ufw.sh
|
|
#
|
|
set -euo pipefail
|
|
[[ "${EUID}" -eq 0 ]] || { echo "Run as root (sudo)."; exit 1; }
|
|
|
|
SSH_PORT="${SSH_PORT:-22}"
|
|
|
|
echo "This will enable UFW: default deny incoming, allow outgoing, allow TCP ${SSH_PORT} (SSH)."
|
|
echo "Tor hidden services use outbound circuits only; no inbound clearnet ports are opened for CyberLux."
|
|
read -r -p "Continue? [y/N] " ok || true
|
|
[[ "${ok:-}" =~ ^[Yy]$ ]] || { echo "Aborted."; exit 0; }
|
|
|
|
ufw default deny incoming
|
|
ufw default allow outgoing
|
|
ufw allow "${SSH_PORT}/tcp" comment "ssh"
|
|
ufw --force enable
|
|
ufw status verbose
|