Skip to content

Commit

Permalink
Merge pull request #8 from tam7t/droplan-rename
Browse files Browse the repository at this point in the history
Rename to droplan
  • Loading branch information
tam7t committed Mar 7, 2016
2 parents 9073f0a + 124f77d commit 3286460
Show file tree
Hide file tree
Showing 5 changed files with 37 additions and 37 deletions.
16 changes: 8 additions & 8 deletions Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -5,14 +5,14 @@ build:
GO15VENDOREXPERIMENT=1 go build .

release:
@env GO15VENDOREXPERIMENT=1 GOOS=linux GOARCH=amd64 go build -ldflags="-X main.appVersion=${DOLAN_VERSION}" -o dolan
@zip dolan_${DOLAN_VERSION}_linux_amd64.zip dolan
@rm dolan
@env GO15VENDOREXPERIMENT=1 GOOS=linux GOARCH=amd64 go build -ldflags="-X main.appVersion=${DROPLAN_VERSION}" -o droplan
@zip droplan_${DROPLAN_VERSION}_linux_amd64.zip droplan
@rm droplan

@env GO15VENDOREXPERIMENT=1 GOOS=linux GOARCH=386 go build -ldflags="-X main.appVersion=${DOLAN_VERSION}" -o dolan
@zip dolan_${DOLAN_VERSION}_linux_386.zip dolan
@rm dolan
@env GO15VENDOREXPERIMENT=1 GOOS=linux GOARCH=386 go build -ldflags="-X main.appVersion=${DROPLAN_VERSION}" -o droplan
@zip droplan_${DROPLAN_VERSION}_linux_386.zip droplan
@rm droplan

clean:
@rm -f dolan
@rm -rf dolan_*.zip
@rm -f droplan
@rm -rf droplan_*.zip
20 changes: 10 additions & 10 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,34 +1,34 @@
# dolan [![Build Status](http://img.shields.io/travis/tam7t/dolan.svg?style=flat-square)](https://travis-ci.org/tam7t/dolan) [![Gitter](https://img.shields.io/gitter/room/tam7t/dolan.js.svg?style=flat-square)](https://gitter.im/tam7t/dolan)
# droplan [![Build Status](http://img.shields.io/travis/tam7t/droplan.svg?style=flat-square)](https://travis-ci.org/tam7t/droplan) [![Gitter](https://img.shields.io/gitter/room/tam7t/droplan.js.svg?style=flat-square)](https://gitter.im/tam7t/droplan)

## About

This utility helps secure the `private` interface on DigitalOcean droplets by
adding `iptable` rules that only allow traffic from your other droplets. `dolan`
adding `iptable` rules that only allow traffic from your other droplets. `droplan`
queries the DigitalOcean API and automatically updates `iptable` rules.

## Installation

The latest release is available on the github [release page](https://github.com/tam7t/dolan/releases).
The latest release is available on the github [release page](https://github.com/tam7t/droplan/releases).

You can setup a cron job to run every 5 minutes in `/etc/cron.d`

```
*/5 * * * * root PATH=/sbin DO_KEY=READONLY_KEY /usr/local/bin/dolan >/var/log/dolan.log 2>&1
*/5 * * * * root PATH=/sbin DO_KEY=READONLY_KEY /usr/local/bin/droplan >/var/log/droplan.log 2>&1
```

## Usage

```
DO_KEY=<read_only_api_token> /path/to/dolan
DO_KEY=<read_only_api_token> /path/to/droplan
```

The `iptables` rules added by `dolan` are equivalent to:
The `iptables` rules added by `droplan` are equivalent to:

```
-N dolan-peers # create a new chain
-A INPUT -i eth1 -j dolan-peers # add chain to private interface
-N droplan-peers # create a new chain
-A INPUT -i eth1 -j droplan-peers # add chain to private interface
-A INPUT -i eth1 -j DROP # add default DROP rule to private interface
-A dolan-peers -s <PEER>/32 -j ACCEPT # allow traffic from PEER ip address
-A droplan-peers -s <PEER>/32 -j ACCEPT # allow traffic from PEER ip address
```

## Development
Expand All @@ -41,5 +41,5 @@ Dependencies are vendored with [govendor](https://github.com/kardianos/govendor)

A `Makefile` is included:
* `test` - runs unit tests
* `build` - builds `dolan` on the current platform
* `build` - builds `droplan` on the current platform
* `release` - builds releasable artifacts
6 changes: 3 additions & 3 deletions main.go
Original file line number Diff line number Diff line change
Expand Up @@ -57,14 +57,14 @@ func main() {
iface, err := PrivateInterface(ifaces, local)
failIfErr(err)

// setup dolan-peers chain for local interface
// setup droplan-peers chain for local interface
err = Setup(ipt, iface)
failIfErr(err)

// update dolan-peers
// update droplan-peers
err = UpdatePeers(ipt, allowed)
failIfErr(err)
log.Printf(`Added %d peers to dolan-peers`, len(allowed))
log.Printf(`Added %d peers to droplan-peers`, len(allowed))
}

func failIfErr(err error) {
Expand Down
12 changes: 6 additions & 6 deletions tables.go
Original file line number Diff line number Diff line change
Expand Up @@ -14,14 +14,14 @@ type IPTables interface {
func Setup(ipt IPTables, ipFace string) error {
var err error

err = ipt.NewChain("filter", "dolan-peers")
err = ipt.NewChain("filter", "droplan-peers")
if err != nil {
if err.Error() != "exit status 1: iptables: Chain already exists.\n" {
return err
}
}

err = ipt.AppendUnique("filter", "INPUT", "-i", ipFace, "-j", "dolan-peers")
err = ipt.AppendUnique("filter", "INPUT", "-i", ipFace, "-j", "droplan-peers")
if err != nil {
return err
}
Expand All @@ -32,17 +32,17 @@ func Setup(ipt IPTables, ipFace string) error {
return nil
}

// UpdatePeers updates the dolan-peers chain in iptables with the specified
// UpdatePeers updates the droplan-peers chain in iptables with the specified
// peers
func UpdatePeers(ipt IPTables, peers []string) error {
// TODO(tam7t): prune `dolan-peers` in a way that doesnt cause downtime
err := ipt.ClearChain("filter", "dolan-peers")
// TODO(tam7t): prune `droplan-peers` in a way that doesnt cause downtime
err := ipt.ClearChain("filter", "droplan-peers")
if err != nil {
return err
}

for _, peer := range peers {
err := ipt.Append("filter", "dolan-peers", "-s", peer, "-j", "ACCEPT")
err := ipt.Append("filter", "droplan-peers", "-s", peer, "-j", "ACCEPT")
if err != nil {
return err
}
Expand Down
20 changes: 10 additions & 10 deletions tables_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ func TestTables(t *testing.T) {
g.It(`creates a new chain`, func() {
sipt.newChain = func(a, b string) error {
g.Assert(a).Equal(`filter`)
g.Assert(b).Equal(`dolan-peers`)
g.Assert(b).Equal(`droplan-peers`)
return nil
}
Setup(sipt, `eth1`)
Expand All @@ -56,7 +56,7 @@ func TestTables(t *testing.T) {
g.It(`returns the error`, func() {
sipt.appendUnique = func(a, b string, c ...string) error {
if a == `filter` && b == `INPUT` && len(c) == 4 {
if c[0] == `-i` && c[1] == `eth1` && c[2] == `-j` && c[3] == `dolan-peers` {
if c[0] == `-i` && c[1] == `eth1` && c[2] == `-j` && c[3] == `droplan-peers` {
return errors.New(`bad add chain`)
}
}
Expand All @@ -80,7 +80,7 @@ func TestTables(t *testing.T) {
})
})

g.It(`adds the dolan-peer chain and deny to the interface`, func() {
g.It(`adds the droplan-peer chain and deny to the interface`, func() {
var params [][]string

sipt.appendUnique = func(a, b string, c ...string) error {
Expand All @@ -93,7 +93,7 @@ func TestTables(t *testing.T) {
Setup(sipt, `eth1`)

g.Assert(params).Equal([][]string{
[]string{`filter`, `INPUT`, `-i`, `eth1`, `-j`, `dolan-peers`},
[]string{`filter`, `INPUT`, `-i`, `eth1`, `-j`, `droplan-peers`},
[]string{`filter`, `INPUT`, `-i`, `eth1`, `-j`, `DROP`},
})
})
Expand All @@ -114,7 +114,7 @@ func TestTables(t *testing.T) {
g.It(`clears the chain`, func() {
sipt.clearChain = func(a, b string) error {
g.Assert(a).Equal(`filter`)
g.Assert(b).Equal(`dolan-peers`)
g.Assert(b).Equal(`droplan-peers`)
return nil
}
UpdatePeers(sipt, peers)
Expand All @@ -137,7 +137,7 @@ func TestTables(t *testing.T) {
g.It(`clears the chain`, func() {
sipt.clearChain = func(a, b string) error {
g.Assert(a).Equal(`filter`)
g.Assert(b).Equal(`dolan-peers`)
g.Assert(b).Equal(`droplan-peers`)
return nil
}
UpdatePeers(sipt, peers)
Expand All @@ -156,7 +156,7 @@ func TestTables(t *testing.T) {
UpdatePeers(sipt, peers)

g.Assert(params).Equal([][]string{
[]string{`filter`, `dolan-peers`, `-s`, `peer1`, `-j`, `ACCEPT`},
[]string{`filter`, `droplan-peers`, `-s`, `peer1`, `-j`, `ACCEPT`},
})
})

Expand Down Expand Up @@ -187,7 +187,7 @@ func TestTables(t *testing.T) {
g.It(`clears the chain`, func() {
sipt.clearChain = func(a, b string) error {
g.Assert(a).Equal(`filter`)
g.Assert(b).Equal(`dolan-peers`)
g.Assert(b).Equal(`droplan-peers`)
return nil
}
UpdatePeers(sipt, peers)
Expand All @@ -206,8 +206,8 @@ func TestTables(t *testing.T) {
UpdatePeers(sipt, peers)

g.Assert(params).Equal([][]string{
[]string{`filter`, `dolan-peers`, `-s`, `peer1`, `-j`, `ACCEPT`},
[]string{`filter`, `dolan-peers`, `-s`, `peer2`, `-j`, `ACCEPT`},
[]string{`filter`, `droplan-peers`, `-s`, `peer1`, `-j`, `ACCEPT`},
[]string{`filter`, `droplan-peers`, `-s`, `peer2`, `-j`, `ACCEPT`},
})
})
})
Expand Down

0 comments on commit 3286460

Please sign in to comment.