setup_firewall

#!/usr/bin/env sh
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw allow http
sudo ufw allow https

read -p "Enter the ip from the machine where your backup CouchDB is running (let empty to pass)" BACKUPIP
[ ! -z "$BACKUPIP" ] && sudo ufw allow from $BACKUPIP to any port 6984

sudo ufw enable

# This actually seem to not be enough so, while waiting for a more effective solution
# make sure to only bind to localhost (ex: 127.0.0.1:9999:8080) when exposing ports
[[ -f /etc/default/docker ]] && {
  echo '
  # Prevent Docker modifying iptables
  # See https://www.techrepublic.com/article/how-to-fix-the-docker-and-ufw-security-flaw/
  DOCKER_OPTS="--iptables=false"
  ' | sudo tee -a /etc/default/docker
}