cinnabarflower/mnemo_cards
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fo

Browse source
This commit is contained in:
Dmitry 2025-11-16 16:16:01 +03:00
parent 18366a6ba4
commit 630d5e1f41
3 changed files with 32 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
mnemo_cards_backend/PROGRESS.md
View file

@ -29,10 +29,11 @@
**Security Features Added:**
- ✅ IP address access blocking for both HTTP and HTTPS (only domain access allowed)
- ✅ Automatic Forgejo ROOT_URL configuration fix
- ✅ Direct port 3000 access blocking (Forgejo listens only on localhost)
- ✅ Automatic Forgejo ROOT_URL and HTTP_ADDR configuration fix
- ✅ SSL certificate validation for domain access
- ✅ Service restart after configuration changes
- ✅ Comprehensive testing for IP blocking and ROOT_URL validation
- ✅ Comprehensive testing for all security measures
**Next Action:** Run updated setup script on server to activate domain configuration with IP blocking and ROOT_URL fix

22
mnemo_cards_web_v2/deploy/fix-forgejo-config.sh
View file

@ -89,8 +89,19 @@ print_success "Config backed up to: $BACKUP_FILE"
print_status "Updating ROOT_URL to https://code.mnemo-cards.online..."
sed -i 's|^ROOT_URL.*=.*|ROOT_URL = https://code.mnemo-cards.online|' "$FORGEJO_CONFIG"
# Verify change
# Update HTTP_ADDR to listen only on localhost (for security)
print_status "Updating HTTP_ADDR to listen only on localhost..."
if grep -q "^HTTP_ADDR" "$FORGEJO_CONFIG"; then
sed -i 's|^HTTP_ADDR.*=.*|HTTP_ADDR = 127.0.0.1|' "$FORGEJO_CONFIG"
else
# Add HTTP_ADDR if not present
sed -i '/^\[server\]/a HTTP_ADDR = 127.0.0.1' "$FORGEJO_CONFIG"
fi
# Verify changes
NEW_ROOT_URL=$(grep -E "^ROOT_URL" "$FORGEJO_CONFIG" | cut -d'=' -f2 | tr -d ' ')
NEW_HTTP_ADDR=$(grep -E "^HTTP_ADDR" "$FORGEJO_CONFIG" | cut -d'=' -f2 | tr -d ' ')
if [ "$NEW_ROOT_URL" = "https://code.mnemo-cards.online" ]; then
print_success "ROOT_URL updated successfully: $NEW_ROOT_URL"
else
@ -98,10 +109,17 @@ else
exit 1
fi
if [ "$NEW_HTTP_ADDR" = "127.0.0.1" ]; then
print_success "HTTP_ADDR updated successfully: $NEW_HTTP_ADDR (localhost only)"
else
print_error "Failed to update HTTP_ADDR!"
exit 1
fi
# Show the full [server] section for verification
print_status "Current [server] section in config:"
echo "----------------------------------------"
sed -n '/^\[server\]/,/^\[/p' "$FORGEJO_CONFIG" | grep -E "(ROOT_URL|DOMAIN|HTTP_PORT|ROOT_PATH)"
sed -n '/^\[server\]/,/^\[/p' "$FORGEJO_CONFIG" | grep -E "(ROOT_URL|HTTP_ADDR|DOMAIN|HTTP_PORT|ROOT_PATH)"
echo "----------------------------------------"
# Restart Forgejo/Gitea service

9
mnemo_cards_web_v2/deploy/test-forgejo-domain.sh
View file

@ -86,6 +86,15 @@ else
print_warning "HTTPS IP access not blocked: $HTTPS_IP_BLOCK_STATUS (should be 444)"
fi
# Test that direct port 3000 access is blocked
print_status "Testing that direct port 3000 access is blocked..."
PORT_3000_STATUS=$(curl -s -o /dev/null -w "%{http_code}" --max-time 5 http://147.45.152.129:3000/)
if [ "$PORT_3000_STATUS" = "000" ]; then
print_success "Direct port 3000 access blocked: $PORT_3000_STATUS ✓"
else
print_warning "Direct port 3000 access not blocked: $PORT_3000_STATUS (should be connection failed)"
fi
# Test SSL certificate
print_status "Testing SSL certificate..."
SSL_INFO=$(openssl s_client -connect code.mnemo-cards.online:443 -servername code.mnemo-cards.online < /dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates 2>/dev/null)