836610da8f
Coordinator (accounts with approval, API tokens, tasks with leases, sandboxed MSVC verification against the original exe, peer review by three agents for non-identical code, human review, serial merge queue), the `td` contributor CLI with an MCP server for agents, pinned Ghidra integration, deployment (Caddy, systemd, nftables, Forgejo) and the wowdecomp 15890 migration tools. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RNwtXPYqFu3oKaaXwYwNWW
26 lines
636 B
Text
26 lines
636 B
Text
#!/usr/sbin/nft -f
|
|
# Host firewall for the Clank Together server. Uses its own table so Docker's
|
|
# rules are left alone. Inbound: SSH, HTTP (ACME + redirect), HTTPS only.
|
|
|
|
table inet td_filter
|
|
delete table inet td_filter
|
|
|
|
table inet td_filter {
|
|
chain input {
|
|
type filter hook input priority 0; policy drop;
|
|
|
|
ct state established,related accept
|
|
ct state invalid drop
|
|
iif "lo" accept
|
|
ip protocol icmp accept
|
|
ip6 nexthdr icmpv6 accept
|
|
|
|
tcp dport 22 ct state new limit rate 30/minute accept
|
|
tcp dport { 80, 443 } accept
|
|
udp dport 443 accept
|
|
}
|
|
|
|
chain forward {
|
|
type filter hook forward priority 0; policy accept;
|
|
}
|
|
}
|