f237fe560d
- Renamed directories: codex-rs -> llmx-rs, codex-cli -> llmx-cli
- Updated package.json files:
- Root: llmx-monorepo
- CLI: @llmx/llmx
- SDK: @llmx/llmx-sdk
- Updated pnpm workspace configuration
- Renamed binary: codex.js -> llmx.js
- Updated environment variables: CODEX_* -> LLMX_*
- Changed repository URLs to valknar/llmx
🤖 Generated with Claude Code
116 lines
3.8 KiB
Bash
116 lines
3.8 KiB
Bash
#!/bin/bash
|
|
set -euo pipefail # Exit on error, undefined vars, and pipeline failures
|
|
IFS=$'\n\t' # Stricter word splitting
|
|
|
|
# Read allowed domains from file
|
|
ALLOWED_DOMAINS_FILE="/etc/codex/allowed_domains.txt"
|
|
if [ -f "$ALLOWED_DOMAINS_FILE" ]; then
|
|
ALLOWED_DOMAINS=()
|
|
while IFS= read -r domain; do
|
|
ALLOWED_DOMAINS+=("$domain")
|
|
done < "$ALLOWED_DOMAINS_FILE"
|
|
echo "Using domains from file: ${ALLOWED_DOMAINS[*]}"
|
|
else
|
|
# Fallback to default domains
|
|
ALLOWED_DOMAINS=("api.openai.com")
|
|
echo "Domains file not found, using default: ${ALLOWED_DOMAINS[*]}"
|
|
fi
|
|
|
|
# Ensure we have at least one domain
|
|
if [ ${#ALLOWED_DOMAINS[@]} -eq 0 ]; then
|
|
echo "ERROR: No allowed domains specified"
|
|
exit 1
|
|
fi
|
|
|
|
# Flush existing rules and delete existing ipsets
|
|
iptables -F
|
|
iptables -X
|
|
iptables -t nat -F
|
|
iptables -t nat -X
|
|
iptables -t mangle -F
|
|
iptables -t mangle -X
|
|
ipset destroy allowed-domains 2>/dev/null || true
|
|
|
|
# First allow DNS and localhost before any restrictions
|
|
# Allow outbound DNS
|
|
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
|
|
# Allow inbound DNS responses
|
|
iptables -A INPUT -p udp --sport 53 -j ACCEPT
|
|
# Allow localhost
|
|
iptables -A INPUT -i lo -j ACCEPT
|
|
iptables -A OUTPUT -o lo -j ACCEPT
|
|
|
|
# Create ipset with CIDR support
|
|
ipset create allowed-domains hash:net
|
|
|
|
# Resolve and add other allowed domains
|
|
for domain in "${ALLOWED_DOMAINS[@]}"; do
|
|
echo "Resolving $domain..."
|
|
ips=$(dig +short A "$domain")
|
|
if [ -z "$ips" ]; then
|
|
echo "ERROR: Failed to resolve $domain"
|
|
exit 1
|
|
fi
|
|
|
|
while read -r ip; do
|
|
if [[ ! "$ip" =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
|
|
echo "ERROR: Invalid IP from DNS for $domain: $ip"
|
|
exit 1
|
|
fi
|
|
echo "Adding $ip for $domain"
|
|
ipset add allowed-domains "$ip"
|
|
done < <(echo "$ips")
|
|
done
|
|
|
|
# Get host IP from default route
|
|
HOST_IP=$(ip route | grep default | cut -d" " -f3)
|
|
if [ -z "$HOST_IP" ]; then
|
|
echo "ERROR: Failed to detect host IP"
|
|
exit 1
|
|
fi
|
|
|
|
HOST_NETWORK=$(echo "$HOST_IP" | sed "s/\.[0-9]*$/.0\/24/")
|
|
echo "Host network detected as: $HOST_NETWORK"
|
|
|
|
# Set up remaining iptables rules
|
|
iptables -A INPUT -s "$HOST_NETWORK" -j ACCEPT
|
|
iptables -A OUTPUT -d "$HOST_NETWORK" -j ACCEPT
|
|
|
|
# Set default policies to DROP first
|
|
iptables -P INPUT DROP
|
|
iptables -P FORWARD DROP
|
|
iptables -P OUTPUT DROP
|
|
|
|
# First allow established connections for already approved traffic
|
|
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
|
|
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
|
|
|
|
# Then allow only specific outbound traffic to allowed domains
|
|
iptables -A OUTPUT -m set --match-set allowed-domains dst -j ACCEPT
|
|
|
|
# Append final REJECT rules for immediate error responses
|
|
# For TCP traffic, send a TCP reset; for UDP, send ICMP port unreachable.
|
|
iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
|
|
iptables -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
|
|
iptables -A OUTPUT -p tcp -j REJECT --reject-with tcp-reset
|
|
iptables -A OUTPUT -p udp -j REJECT --reject-with icmp-port-unreachable
|
|
iptables -A FORWARD -p tcp -j REJECT --reject-with tcp-reset
|
|
iptables -A FORWARD -p udp -j REJECT --reject-with icmp-port-unreachable
|
|
|
|
echo "Firewall configuration complete"
|
|
echo "Verifying firewall rules..."
|
|
if curl --connect-timeout 5 https://example.com >/dev/null 2>&1; then
|
|
echo "ERROR: Firewall verification failed - was able to reach https://example.com"
|
|
exit 1
|
|
else
|
|
echo "Firewall verification passed - unable to reach https://example.com as expected"
|
|
fi
|
|
|
|
# Always verify OpenAI API access is working
|
|
if ! curl --connect-timeout 5 https://api.openai.com >/dev/null 2>&1; then
|
|
echo "ERROR: Firewall verification failed - unable to reach https://api.openai.com"
|
|
exit 1
|
|
else
|
|
echo "Firewall verification passed - able to reach https://api.openai.com as expected"
|
|
fi
|