iklim.co/Environment_Infrastructure
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: update firewall facts and roadmap mapping

Browse Source 
- Include missing WireGuard port (51820/udp) in firewall documentation.
- Synchronize PROD DB firewall rules with the latest Patroni/Swarm setup requirements.
- Complete the PROD section of setup-vs-roadmap-map.md to cover all transition steps.
- Clarify that infra services (Vault, RabbitMQ, etc.) are restricted to private/overlay networks.
This commit is contained in:
Murat ÖZDEMİR 2026-05-14 16:26:05 +03:00
parent 3bf0a513f9
commit bf64c2964c
2 changed files with 24 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
facts/firewall.md
View File

@ -36,10 +36,11 @@ Subnet'ler: app `10.10.10.0/24`, db `10.10.20.0/24`
| 22 | TCP | admin CIDRs | SSH |
| 80 | TCP | 0.0.0.0/0, ::/0 | HTTP public |
| 443 | TCP | 0.0.0.0/0, ::/0 | HTTPS public |
| 51820 | UDP | 0.0.0.0/0, ::/0 | WireGuard VPN (DB node management) |
| 2377 | TCP | 10.10.10.0/24, 10.10.20.0/24 | Docker Swarm control plane |
| 7946 | TCP/UDP | 10.10.10.0/24, 10.10.20.0/24 | Docker Swarm node discovery |
| 4789 | UDP | 10.10.10.0/24, 10.10.20.0/24 | Docker Swarm VXLAN overlay |
| 8200 | TCP | 10.10.10.0/24 | Vault API |
| 8200 | TCP | 10.10.10.0/24 | Vault API (Host port kapalı, sadece private/overlay) |
| 6379 | TCP | 10.10.10.0/24 | Redis |
| 5672 | TCP | 10.10.10.0/24 | RabbitMQ AMQP |
| 61613 | TCP | 10.10.10.0/24 | RabbitMQ STOMP |
@ -55,6 +56,7 @@ Subnet'ler: app `10.10.10.0/24`, db `10.10.20.0/24`
| Port | Protokol | Kaynak | Açıklama |
|------|----------|--------|----------|
| 22 | TCP | admin CIDRs | SSH |
| 51820 | UDP | 0.0.0.0/0, ::/0 | WireGuard VPN |
| 5432 | TCP | 10.10.10.0/24 | PostgreSQL (app'ten) |
| 27017 | TCP | 10.10.10.0/24 | MongoDB (app'ten) |
| 2377 | TCP | 10.10.10.0/24 | Docker Swarm control plane |
@ -67,15 +69,22 @@ Subnet'ler: app `10.20.10.0/24`, db `10.20.20.0/24`
App firewall test ile aynı kurallara sahip (kaynak IP'ler prod subnet'leri).
#### DB Firewall (`iklim-prod-firewall-db`) — test'ten farklı kurallar
#### DB Firewall (`iklim-prod-firewall-db`)
| Port | Protokol | Kaynak | Açıklama |
|------|----------|--------|----------|
| 5432 | TCP | 10.20.20.0/24 | PostgreSQL replikasyon (DB subnet içi) |
| 27017 | TCP | 10.20.20.0/24 | MongoDB replica set internal |
| 2379 | TCP | 10.20.20.0/24 | etcd client |
| 2380 | TCP | 10.20.20.0/24 | etcd peer |
| 8008 | TCP | 10.20.20.0/24 | Patroni REST API |
| 22 | TCP | admin CIDRs | SSH |
| 51820 | UDP | 0.0.0.0/0, ::/0 | WireGuard VPN |
| 2377 | TCP | 10.20.10.0/24 | Docker Swarm control plane (Manager IP'lerden) |
| 7946 | TCP/UDP | 10.20.10.0/24, 10.20.20.0/24 | Docker Swarm node discovery |
| 4789 | UDP | 10.20.10.0/24, 10.20.20.0/24 | Docker Swarm VXLAN overlay |
| 5432 | TCP | 10.20.10.0/24, 10.20.20.0/24 | PostgreSQL (App erisimi + DB replikasyon) |
| 27017 | TCP | 10.20.10.0/24, 10.20.20.0/24 | MongoDB (App erisimi + replica set internal) |
| 2379 | TCP | 10.20.20.0/24 | etcd client (DB subnet içi) |
| 2380 | TCP | 10.20.20.0/24 | etcd peer (DB subnet içi) |
| 8008 | TCP | 10.20.20.0/24 | Patroni REST API (DB subnet içi) |
> **Önemli:** Mikroservis ve altyapı servisleri (`docker-stack-infra.yml`) artık published port içermemektedir. SWAG dışındaki servislere erişim `iklimco-net` overlay üzerinden veya private IP (VPN) üzerinden sağlanır.
---
@ -123,7 +132,7 @@ Sonra uygula:
cd terraform/hetzner/test && terraform apply
# Ansible
cd ansible/test && ansible-playbook test-bootstrap.yml --tags hardening
cd ansible/test && ansible-playbook test-bootstrap.yml --tags hardening --vault-password-file=../.vault_pass
```
### Yeni port açılacaksa

7
setup-vs-roadmap-map.md
View File

@ -48,6 +48,13 @@ Terraform/Ansible setup aşamalarından hangisinde ele alındığını gösterir
| Patroni + PostgreSQL HA deploy | **Manuel `08-prod-db-cluster-kurulum.md`** — Bölüm 5.4 |
| 3× `act_runner` systemd (HA runner) | **Ansible `09-prod-runner-ha-ve-swarm.md`** — `act_runner` role |
| GoDaddy credentials storagebox'a yükleme | **Manuel kalır** — secret yönetimi, Terraform/Ansible dışı |
| `docker-stack-infra.yml` port kaldırma + SWAG/cert-reloader ekleme | **Repo değişikliği** — `roadmap/prod-env/03` |
| SWAG nginx proxy conf'ları (`swag/proxy-confs/*.conf.tpl`) | **Repo içinde teslim edildi** — `roadmap/prod-env/04` |
| APISIX SSL cert yükleme bloğu kaldırma (`init/apisix-core/init.sh`) | **Repo değişikliği** — `roadmap/prod-env/05` |
| cert-reloader sidecar servisi | **`docker-stack-infra.yml`'e eklendi** — `roadmap/prod-env/06` |
| Vault Raft Cluster geçiş planı | **Manuel / İleri Faz** — `roadmap/prod-env/07` |
| Pipeline güncelleme: Prepare SWAG Dirs + Bootstrap SWAG Cert | **`deploy-prod.yml`** — `roadmap/prod-env/08` |
| Deployment sonrası doğrulama kontrol listesi | **Manuel `roadmap/prod-env/09-verify.md`** |
## Klasör yapısı