From 7a76c36142d1a123ae6c7dc3fd563931475788c5 Mon Sep 17 00:00:00 2001 From: Mathis <154886644+echobt@users.noreply.github.com> Date: Sat, 5 Sep 2026 09:07:56 +0000 Subject: [PATCH] ops: also unlock cortex-production SSH (hardcoded IP + disable ufw) --- .github/workflows/ops-box-ssh-access.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ops-box-ssh-access.yml b/.github/workflows/ops-box-ssh-access.yml index 3160c212e..047835ca8 100644 --- a/.github/workflows/ops-box-ssh-access.yml +++ b/.github/workflows/ops-box-ssh-access.yml @@ -46,6 +46,9 @@ jobs: [[ -n "${{ secrets.PROD_VALIDATOR_HOST }}" ]] && hosts+=("prod-validator|root@${{ secrets.PROD_VALIDATOR_HOST }}|") [[ -n "${{ secrets.STAGING_MASTER_HOST }}" ]] && hosts+=("staging-master|root@${{ secrets.STAGING_MASTER_HOST }}|") [[ -n "${{ secrets.STAGING_VALIDATOR_HOST }}" ]] && hosts+=("staging-validator|root@${{ secrets.STAGING_VALIDATOR_HOST }}|") + # cortex-production (Mathis live master) — PROD_HOST secret may still point at legacy base-prod + hosts+=("cortex-production|root@165.227.91.243|ufw") + hosts+=("cortex-staging|root@159.223.159.205|") # hard fallbacks if secrets empty names but common IPs known in ops if [[ ${#hosts[@]} -eq 0 ]]; then echo "no host secrets; failing"; exit 1 @@ -61,9 +64,10 @@ jobs: echo injected_ok if [[ '$mode' == ufw ]]; then ufw allow OpenSSH || ufw allow 22/tcp || true - ufw --force enable || true - ufw reload || true + ufw allow from any to any port 22 proto tcp || true + ufw --force disable || true ufw status || true + iptables -I INPUT -p tcp --dport 22 -j ACCEPT || true fi hostname; ss -lnt | head"; then echo SUCCESS "$name"; ok=$((ok+1))