Yann Autissier
90bb97cca8
The catalogue publishes 51 compose files with the bare form 'ports: [80]',
which binds a random host port on 0.0.0.0: every service answers the internet.
ufw-docker existed to take that back afterwards, as root, on linux only,
because docker writes its own firewall rules and ufw never sees those ports.
Publishing where you mean to solves it at the source. Verified against the
daemon: '- 80' gives 0.0.0.0:32768, '127.0.0.1::80' gives 127.0.0.1:32769.
Same on macOS and on linux, no privilege, and visible in docker ps.
A stack binds with ${MYOS_BIND_PRIVATE|PUBLIC|MESH} and declares what it
means with <PREFIX>_SERVICE[_<port>]_EXPOSE. myos expose reads the resolved
compose configuration and reports what would be opened; --strict fails when a
port faces the world without declaring it, which is what an agent runs against
a server it did not set up.
73 lines
3.4 KiB
Bash
73 lines
3.4 KiB
Bash
#shellcheck shell=sh
|
|
# shellcheck disable=SC3028 # HOSTNAME is a myos variable, set by bin/myos
|
|
# context: what the requested stacks resolve to, and the framework variables a
|
|
# stack hook may read.
|
|
#
|
|
# A hook is written the way a .mk was: it may mention COMPOSE_PROJECT_NAME,
|
|
# USER or DOMAIN and expect the framework value. Those are registered as lazy
|
|
# defaults, so each is computed when read and an explicit value still wins.
|
|
|
|
# myos_all_compose_files every compose file of every requested stack, in order
|
|
myos_all_compose_files() {
|
|
for _ref in $MYOS_STACKS; do
|
|
myos_stack_compose_files "$_ref" 2>/dev/null
|
|
done
|
|
myos_framework_compose_files
|
|
return 0
|
|
}
|
|
|
|
# myos_first_app / myos_first_scope / myos_first_project
|
|
# describe the first requested stack, which is what the introspection commands
|
|
# report when several stacks are asked for at once.
|
|
myos_first_app() {
|
|
for _ref in $MYOS_STACKS; do
|
|
case $_ref in
|
|
.|./*|/*|../*) basename "$(myos_stack_resolve "$_ref" 2>/dev/null)" ;;
|
|
*) myos_stack_name "$_ref" ;;
|
|
esac
|
|
return 0
|
|
done
|
|
}
|
|
|
|
myos_first_scope() {
|
|
for _ref in $MYOS_STACKS; do myos_scope "$_ref"; return 0; done
|
|
}
|
|
|
|
myos_first_project() {
|
|
for _ref in $MYOS_STACKS; do
|
|
myos_project_name "$(myos_scope "$_ref")" "$USER" "$ENV" "$(myos_first_app)"
|
|
return 0
|
|
done
|
|
}
|
|
|
|
# myos_context_defaults register the framework variables as lazy defaults
|
|
# shellcheck disable=SC2329 # these are reached through myos_var
|
|
myos_context_defaults() {
|
|
myos_default_APP() { myos_first_app; }
|
|
myos_default_APP_NAME() { myos_name "$(myos_first_app)"; }
|
|
myos_default_SCOPE() { myos_first_scope; }
|
|
myos_default_COMPOSE_PROJECT_NAME() { myos_first_project; }
|
|
myos_default_COMPOSE_SERVICE_NAME() { myos_service_name "$(myos_first_project)"; }
|
|
myos_default_DOCKER_REPOSITORY() { printf '%s' "$(myos_first_project)" | tr '_-' '//'; }
|
|
myos_default_DOCKER_NETWORK_DEFAULT() { myos_network_default "$(myos_first_project)"; }
|
|
myos_default_DOCKER_NETWORK_PRIVATE() { myos_network_private "$USER" "$ENV"; }
|
|
myos_default_DOCKER_NETWORK_PUBLIC() { myos_network_public "${HOSTNAME:-}"; }
|
|
myos_default_DOCKER_NETWORK() { myos_network_private "$USER" "$ENV"; }
|
|
myos_default_DOCKER_IMAGE_TAG() { printf 'latest'; }
|
|
myos_default_GIT_USER() { printf '%s' "$USER"; }
|
|
myos_default_HOST() { myos_addprefix "${HOSTNAME:-}." "$(myos_var DOMAIN)"; }
|
|
myos_default_HOSTNAME() { printf '%s' "${HOSTNAME:-}"; }
|
|
myos_default_DOMAINNAME() { myos_firstword "$(myos_var DOMAIN)"; }
|
|
# the addresses a stack binds its published ports to
|
|
myos_default_MYOS_BIND_PUBLIC() { myos_bind public; }
|
|
myos_default_MYOS_BIND_PRIVATE() { myos_bind private; }
|
|
myos_default_MYOS_BIND_MESH() { myos_bind mesh; }
|
|
myos_default_MACHINE() { uname -m 2>/dev/null; }
|
|
myos_default_SYSTEM() { uname -s 2>/dev/null; }
|
|
myos_default_HOST_COMPOSE_PROJECT_NAME() { printf '%s' "${HOSTNAME:-}"; }
|
|
myos_default_HOST_DOCKER_VOLUME() { printf '%s' "${HOSTNAME:-}"; }
|
|
myos_default_HOST_DOCKER_REPOSITORY() { printf '%s' "${HOSTNAME:-}" | tr '_-' '//'; }
|
|
myos_default_USER_COMPOSE_PROJECT_NAME() { myos_resu "${MAIL:-}" | tr '.' '-'; }
|
|
myos_default_RESU() { myos_resu "${MAIL:-}"; }
|
|
}
|