Vanguard media stack: ingest, copyparty, Syncthing, normalize sweep, Authentik, Jellyfin + Vanguard Metadata plugin, MariaDB, Gitea, bot runtime

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

firewall/firewall.sh

@@ -0,0 +1,22 @@
+#!/bin/bash
+# Install + enable the host firewall. Run with sudo from the bundle dir.
+# Keep your current SSH session open and test a NEW connection before closing it.
+set -euo pipefail
+cd "$(dirname "$0")"
+[[ $EUID -eq 0 ]] || { echo "run with sudo"; exit 1; }
+
+apt-get install -y -q nftables >/dev/null
+install -m 0644 nftables.conf /etc/nftables.conf
+
+echo "== syntax check"; nft -c -f /etc/nftables.conf
+echo "== apply";        nft -f /etc/nftables.conf
+systemctl enable nftables >/dev/null 2>&1 || true   # loads /etc/nftables.conf at boot, before docker
+
+echo "== active ruleset (vanguard table)"
+nft list table inet vanguard | sed 's/^/   /'
+echo
+echo "== listening on public interfaces (should be 22 80 443 1935 2222 3306 8890 22000 only)"
+ss -tulpnH | awk '$5 !~ /^(127\.|\[::1\])/ {print "   "$1, $5}' | sort -u
+echo
+echo "Now open a SECOND terminal and confirm: ssh debian@$(hostname -f 2>/dev/null || hostname)"
+echo "To restrict SSH to your IPs, edit the ssh_allow set in /etc/nftables.conf and re-run: sudo nft -f /etc/nftables.conf"