add nftables rules for quay

4 weeks ago · 1800e0e4e3
2 changed files with 8 additions and 1 deletions
--- a/cookbooks/quay/Makefile
+++ b/cookbooks/quay/Makefile
@ -6,7 +6,7 @@
 PROJECT_UID = 10026
 PROJECT_GID = 10000

-DEPENDENCIES = postgresql lego
+DEPENDENCIES = postgresql lego nftables

 # Include common Makefile
 include ../../scripts/common.mk
--- a/cookbooks/quay/other/nftables/50-quay.nft
+++ b/cookbooks/quay/other/nftables/50-quay.nft
@ -0,0 +1,7 @@
+#!/usr/sbin/nft -f
+
+# Lego listens on port 80 and Quay on port 8443
+add rule inet itix-fw input tcp dport { 80, 8443 } counter accept
+
+# Redirect port 443 to 8443 (Quay)
+add rule inet itix-nat prerouting tcp dport 443 counter redirect to 8443