sorb/axion1337.chat-gitops
1
0
Fork 0
Code Issues Pull Requests Packages Projects 1 Releases 24 Wiki Activity

[CRITICAL] Hetzner Cloud Firewall: Default-Deny Setup #4

New Issue
Closed
opened 2026-05-14 21:41:56 +00:00 by sorb · 3 comments
sorb commented 2026-05-14 21:41:56 +00:00
Owner
Copy Link
Copy Source

Implement Hetzner Cloud Firewall. Allow 80/443 and SSH, block everything else. Impact: Blocks 99% of background noise. Est. Time: 30 min

Implement Hetzner Cloud Firewall. Allow 80/443 and SSH, block everything else. Impact: Blocks 99% of background noise. Est. Time: 30 min
sorb added this to the aXion1337 Roadmap project 2026-05-14 21:48:02 +00:00
sorb added the priority:criticalarea:security labels 2026-05-14 21:49:06 +00:00
sorb commented 2026-05-14 21:50:18 +00:00
Author
Owner
Copy Link
Copy Source

ai slop already done

ai slop already done
sorb moved this to ready in aXion1337 Roadmap on 2026-05-14 21:55:15 +00:00
sorb commented 2026-05-15 11:47:51 +00:00
Author
Owner
Copy Link
Copy Source

✅ COMPLETE (2026-05-15)

Hetzner Cloud Firewall konfiguriert:

  • SSH: Port 2248, spezifische IPs (178.25.213.70, 2a02:8108:0:2f::/64)
  • HTTP/HTTPS: Any IPv4/IPv6 (80, 443)
  • TURN/STUN: WebRTC Ports (3478, 5349, 49152-65535 UDP)
  • RTC Services: SFU + Auth Ports
  • SMTP: Port 587

Status: Optimiert über Plan (mehr Services erlaubt für Full-Stack).
Security: Default-Deny für nicht-definierte Traffic.

Fix Issue: #4

✅ **COMPLETE** (2026-05-15) Hetzner Cloud Firewall konfiguriert: - SSH: Port 2248, spezifische IPs (178.25.213.70, 2a02:8108:0:2f::/64) - HTTP/HTTPS: Any IPv4/IPv6 (80, 443) - TURN/STUN: WebRTC Ports (3478, 5349, 49152-65535 UDP) - RTC Services: SFU + Auth Ports - SMTP: Port 587 Status: Optimiert über Plan (mehr Services erlaubt für Full-Stack). Security: Default-Deny für nicht-definierte Traffic. Fix Issue: #4
sorb closed this issue 2026-05-15 11:48:08 +00:00
sorb moved this to done in aXion1337 Roadmap on 2026-05-15 12:05:16 +00:00
sorb commented 2026-08-01 14:25:55 +00:00
Author
Owner
Copy Link
Copy Source

Migriert nach git.lab: axion1337.chat/axion1337.chat-gitops#4 (nur im Lab bzw. via VPN erreichbar — das Lab ist seit 2026-08-01 die Quelle der Wahrheit, siehe gitops#48). Weiterarbeit dort; dieses Gitea-Issue bleibt als Verweis stehen.

**Migriert nach git.lab**: [axion1337.chat/axion1337.chat-gitops#4](https://git.lab/axion1337.chat/axion1337.chat-gitops/-/issues/4) (nur im Lab bzw. via VPN erreichbar — das Lab ist seit 2026-08-01 die Quelle der Wahrheit, siehe gitops#48). Weiterarbeit dort; dieses Gitea-Issue bleibt als Verweis stehen.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area:authentik
Authentik Identity Provider
 area:database
Database and backups
 area:element
Element and UI
 area:infrastructure
K3S and infrastructure
 area:security
Security hardening
 priority:critical
Critical - This week
 priority:high
High - 1-2 weeks
 priority:low
Low - nice to have
 priority:medium
Medium - ~1 month
No labels area:security priority:critical
Milestone
No items
No Milestone
Projects
Clear projects
No projects
aXion1337 Roadmap
done
Assignees
Clear assignees
sorb (ScrublordMcBad)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sorb/axion1337.chat-gitops#4