mirror of
https://github.com/Such-Software/wownerogue.git
synced 2026-10-18 14:51:26 +02:00
jwinterm
fad2a695bd
A browser-based roguelike synchronized with crypto block timing. A run is a race against the next block: reach the exit before the block lands, or the house wins. The same codebase runs the solo dungeon, the social Tavern, and operator-selected PvP and race rulesets, with separate free and paid leaderboards. Self-hostable under the MIT License. See README.md to run it, docs/ARCHITECTURE.md for the design, and docs/DEPLOY.md to operate an instance.
27 lines
1008 B
Bash
27 lines
1008 B
Bash
#!/bin/sh
|
|
set -eu
|
|
|
|
# Idempotent application/RPC isolation. Install mode 0755 at
|
|
# /usr/local/sbin/wowngeon-firewall and provide NPM_SOURCE_IPV4 through the unit's EnvironmentFile.
|
|
: "${NPM_SOURCE_IPV4:?Set NPM_SOURCE_IPV4 to the reverse proxy address}"
|
|
|
|
ensure_rule() {
|
|
command_name=$1
|
|
shift
|
|
if ! "$command_name" -C INPUT "$@" 2>/dev/null; then
|
|
"$command_name" -I INPUT 1 "$@"
|
|
fi
|
|
}
|
|
|
|
# Only the reverse proxy (and local probes) may reach either Node listener.
|
|
ensure_rule /usr/sbin/iptables ! -i lo ! -s "$NPM_SOURCE_IPV4" \
|
|
-p tcp -m multiport --dports 3000,3001 -j REJECT
|
|
ensure_rule /usr/sbin/ip6tables ! -i lo \
|
|
-p tcp -m multiport --dports 3000,3001 -j REJECT
|
|
|
|
# Wallet and daemon JSON-RPC are local control planes. P2P ports are intentionally untouched.
|
|
ensure_rule /usr/sbin/iptables ! -i lo \
|
|
-p tcp -m multiport --dports 34568,34570,38081,38083 -j REJECT
|
|
ensure_rule /usr/sbin/ip6tables ! -i lo \
|
|
-p tcp -m multiport --dports 34568,34570,38081,38083 -j REJECT
|