48 lines
1.8 KiB
Bash
48 lines
1.8 KiB
Bash
#!/bin/sh
|
||
# ============================================================
|
||
# OpenClaw Gitea webhook 通道：群晖主机 8899 -> OpenClaw 容器
|
||
# 幂等：重复运行不会产生重复规则；需 root 运行
|
||
# 适用：群晖 DSM 7.x，任务计划-开机启动
|
||
# ============================================================
|
||
export PATH=/sbin:/bin:/usr/sbin:/usr/bin:$PATH
|
||
|
||
OC_IP="172.21.0.2" # OpenClaw 容器 IP（容器重建后若 IP 变了，改这里）
|
||
PORT="8899" # 接收服务端口
|
||
LOG="/volume1/scripts/openclaw-webhook-iptables.log"
|
||
|
||
mkdir -p "$(dirname "$LOG")" 2>/dev/null
|
||
log() { echo "[$(date '+%F %T')] $*" >> "$LOG"; }
|
||
|
||
log "=== run start (OC_IP=$OC_IP PORT=$PORT) ==="
|
||
|
||
# --- 1) DNAT：群晖主机 PORT -> OpenClaw 容器 ---
|
||
if iptables -t nat -C PREROUTING -p tcp --dport "$PORT" \
|
||
-j DNAT --to-destination "$OC_IP:$PORT" 2>/dev/null; then
|
||
log "DNAT 已存在，跳过"
|
||
else
|
||
iptables -t nat -A PREROUTING -p tcp --dport "$PORT" \
|
||
-j DNAT --to-destination "$OC_IP:$PORT" && log "已添加 DNAT"
|
||
fi
|
||
|
||
# --- 2) 放行跨 docker 网络转发（插到 DOCKER-USER 最前，绕过隔离 DROP）---
|
||
# 开机时 docker 可能还没起，先等 DOCKER-USER 链就绪
|
||
i=0
|
||
while ! iptables -L DOCKER-USER -n >/dev/null 2>&1; do
|
||
i=$((i+1))
|
||
[ "$i" -gt 36 ] && { log "等待 DOCKER-USER 超时，放弃"; exit 1; }
|
||
sleep 5
|
||
done
|
||
|
||
if iptables -C DOCKER-USER -p tcp -d "$OC_IP" --dport "$PORT" -j ACCEPT 2>/dev/null; then
|
||
log "DOCKER-USER 放行已存在，跳过"
|
||
else
|
||
iptables -I DOCKER-USER 1 -p tcp -d "$OC_IP" --dport "$PORT" -j ACCEPT \
|
||
&& log "已添加 DOCKER-USER 放行"
|
||
fi
|
||
|
||
log "=== run done ==="
|
||
|
||
# 可选的即时自检（注释掉即可）
|
||
# iptables -t nat -L PREROUTING -n | grep ":$PORT"
|
||
# iptables -L DOCKER-USER -n | grep "$OC_IP"
|