ops: 新增 Gitea webhook→OpenClaw 通道的 iptables 开机脚本（issue #24）

2026-09-12 14:02:46 +08:00
parent 84912ef99c
commit 4ecab4c47c
2 changed files with 77 additions and 0 deletions
@@ -0,0 +1,47 @@
+#!/bin/sh
+# ============================================================
+# OpenClaw Gitea webhook 通道：群晖主机 8899 -> OpenClaw 容器
+# 幂等：重复运行不会产生重复规则；需 root 运行
+# 适用：群晖 DSM 7.x，任务计划-开机启动
+# ============================================================
+export PATH=/sbin:/bin:/usr/sbin:/usr/bin:$PATH
+
+OC_IP="172.21.0.2"              # OpenClaw 容器 IP（容器重建后若 IP 变了，改这里）
+PORT="8899"                     # 接收服务端口
+LOG="/volume1/scripts/openclaw-webhook-iptables.log"
+
+mkdir -p "$(dirname "$LOG")" 2>/dev/null
+log() { echo "[$(date '+%F %T')] $*" >> "$LOG"; }
+
+log "=== run start (OC_IP=$OC_IP PORT=$PORT) ==="
+
+# --- 1) DNAT：群晖主机 PORT -> OpenClaw 容器 ---
+if iptables -t nat -C PREROUTING -p tcp --dport "$PORT" \
+      -j DNAT --to-destination "$OC_IP:$PORT" 2>/dev/null; then
+  log "DNAT 已存在，跳过"
+else
+  iptables -t nat -A PREROUTING -p tcp --dport "$PORT" \
+      -j DNAT --to-destination "$OC_IP:$PORT" && log "已添加 DNAT"
+fi
+
+# --- 2) 放行跨 docker 网络转发（插到 DOCKER-USER 最前，绕过隔离 DROP）---
+#     开机时 docker 可能还没起，先等 DOCKER-USER 链就绪
+i=0
+while ! iptables -L DOCKER-USER -n >/dev/null 2>&1; do
+  i=$((i+1))
+  [ "$i" -gt 36 ] && { log "等待 DOCKER-USER 超时，放弃"; exit 1; }
+  sleep 5
+done
+
+if iptables -C DOCKER-USER -p tcp -d "$OC_IP" --dport "$PORT" -j ACCEPT 2>/dev/null; then
+  log "DOCKER-USER 放行已存在，跳过"
+else
+  iptables -I DOCKER-USER 1 -p tcp -d "$OC_IP" --dport "$PORT" -j ACCEPT \
+      && log "已添加 DOCKER-USER 放行"
+fi
+
+log "=== run done ==="
+
+# 可选的即时自检（注释掉即可）
+# iptables -t nat -L PREROUTING -n | grep ":$PORT"
+# iptables -L DOCKER-USER -n | grep "$OC_IP"