From 18a1d1ee0beb6c7ae149341d1818e960da7d33ee Mon Sep 17 00:00:00 2001 From: Jim Martens Date: Sat, 2 Aug 2025 20:25:11 +0200 Subject: [PATCH] fix: Open port 2377 only on manager nodes --- terraform/modules/docker-network/swarm-node.tf | 1 + .../docker-network/templates/scripts/firewall-setup.sh.tftpl | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/terraform/modules/docker-network/swarm-node.tf b/terraform/modules/docker-network/swarm-node.tf index 70975e3..060a293 100644 --- a/terraform/modules/docker-network/swarm-node.tf +++ b/terraform/modules/docker-network/swarm-node.tf @@ -78,6 +78,7 @@ resource "hcloud_server" "node" { packages_setup : base64encode(file("${path.module}/templates/scripts/install-packages.sh")) firewall_setup : base64encode(templatefile("${path.module}/templates/scripts/firewall-setup.sh.tftpl", { node_ip : var.private_node_ips[count.index] + main_node : count.index == 0 })) ssh_setup : base64encode(templatefile("${path.module}/templates/scripts/ssh-setup.sh.tftpl", { admin_user : var.admin_user diff --git a/terraform/modules/docker-network/templates/scripts/firewall-setup.sh.tftpl b/terraform/modules/docker-network/templates/scripts/firewall-setup.sh.tftpl index 6ec2b32..2c00074 100644 --- a/terraform/modules/docker-network/templates/scripts/firewall-setup.sh.tftpl +++ b/terraform/modules/docker-network/templates/scripts/firewall-setup.sh.tftpl @@ -7,7 +7,9 @@ ufw allow OpenSSH ufw allow 80 comment HTTP ufw allow 443 comment HTTPS -ufw allow to ${node_ip} port 2377 comment "Swarm join port" +%{if main_node ~} +ufw allow to ${node_ip} port 2377 comment "Swarm join port and communication between manager nodes" +%{endif ~} ufw allow to ${node_ip} port 7946 comment "overlay network node discovery" ufw allow to ${node_ip} port 4789 comment "overlay network traffic" ufw enable