feat: ufw firewall support, OpenRVDAS data port handling, and home-dir traversal fix#5
Merged
davidpablocohn merged 4 commits intoMay 20, 2026
Conversation
… configurable
Addresses issue 5 from CJ-Sandoz ubuntu_24_install log: ufw was
blocking CachedDataServer websocket (8766/tcp) and UDP instrument
data ports (6224-6226/udp), silently breaking logger communication.
Changes:
- Add openrvdas_data_port (8766), openrvdas_udp_ports ([6224,6225,6226]),
and ufw_openrvdas_source ("any") to all.yml
- ufw.yml opens these ports automatically when install_ufw is true;
ufw_openrvdas_source controls the allowed source — use "127.0.0.1"
for localhost-only on laptop/dev, "any" for vessel LAN
- configure_and_install.sh prompts "Restrict OpenRVDAS data ports to
localhost only?" when ufw is enabled, writes ufw_openrvdas_source to
host_vars, persists answer in .configure_preferences
- Supervisor templates: replace hardcoded 8766 with {{ openrvdas_data_port }}
in both cached_data_server and logger_manager configs
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
CachedDataServer binds on all interfaces but 8766 does not need to be
open in ufw:
- Browser access is proxied through nginx /cds-ws (already open on
server_port)
- Logger processes connect via loopback — no firewall rule needed
- host='' is hardcoded in cached_data_server.py, so --host 127.0.0.1
is not available as a CLI option
The ufw rules now only open the UDP instrument data ports (6224-6226),
controlled by ufw_openrvdas_source ("any" for vessel LAN,
"127.0.0.1" for laptop/dev). Update configure_and_install.sh prompt
and all.yml comments accordingly.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
nginx (www-data) and supervisord must traverse every directory component of install_root. Restrictive defaults (/home dirs are 750 on Ubuntu 24.04, /root is 700, custom paths may vary) cause EACCES on chdir and nginx 502s. - Replace the /home/-specific fix in roles/nginx with a generalised task in roles/common/tasks/directories.yml that chmod o+x all parent directory components of install_root (from the filesystem root down to the parent of install_root, skipping install_root itself which is owned by rvdas). Idempotent on already-755 standard system directories. - Remove the now-redundant nginx-specific home-dir task - Broaden the configure_and_install.sh warning to cover any non-standard install location, not just /home Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…itignore settings.json allows common read-only and test-runner Bash commands without prompting, so background subagents (test-runner, etc.) can run ansible-playbook, docker, git, and gh commands unattended. .gitignore: add ci-test-runner.ini and hosts-docker-test.ini alongside the existing ci-local.ini exclusion. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ufw firewall support for Ubuntu/Debian — automatically opens SSH, the web console port, and the OpenRVDAS UDP instrument data ports (6224–6226); CachedDataServer (8766) is intentionally excluded since browser access is already proxied via nginx
/cds-wsand logger processes connect via loopback.ufw_openrvdas_sourcecontrols whether UDP ports are open to the LAN (any) or localhost only (127.0.0.1for laptop/dev).configure_and_install.shprompts for ufw configuration on Ubuntu/Debian hosts and persists the answer to host_vars.OpenRVDAS data port variables —
openrvdas_data_port(8766) andopenrvdas_udp_ports([6224, 6225, 6226]) added toall.yml; both supervisor templates (cached_data_server,logger_manager) now use{{ openrvdas_data_port }}instead of the hardcoded 8766.Home/custom directory traversal fix — nginx (
www-data) and supervisord need world-execute permission on every directory component ofinstall_rootto traverse the path. Ubuntu 24.04 creates home directories aschmod 750by default;/rootis700. A generalised task inroles/common/tasks/directories.ymlnow runschmod o+xon all parent components ofinstall_root(idempotent on already-755 standard locations like/opt). The previous nginx-specific task that only fixed the top-level home dir has been removed..claude/settings.json— Claude Code project settings allowing common commands without prompts, useful for contributors using Claude Code on this repo. Can be omitted if not wanted.Test plan
ansible-playbook site.yml --syntax-check🤖 Generated with Claude Code