{"id":13649707,"url":"https://github.com/tam7t/droplan","last_synced_at":"2025-07-29T09:32:21.866Z","repository":{"id":57592318,"uuid":"50146091","full_name":"tam7t/droplan","owner":"tam7t","description":"Manage iptable rules for the private interface on DigitalOcean droplets","archived":false,"fork":false,"pushed_at":"2017-06-10T02:32:23.000Z","size":186,"stargazers_count":69,"open_issues_count":4,"forks_count":12,"subscribers_count":4,"default_branch":"master","last_synced_at":"2024-11-10T00:33:13.073Z","etag":null,"topics":["digitalocean","iptables"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/tam7t.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2016-01-22T00:19:45.000Z","updated_at":"2024-05-31T10:52:15.000Z","dependencies_parsed_at":"2022-09-14T09:11:23.967Z","dependency_job_id":null,"html_url":"https://github.com/tam7t/droplan","commit_stats":null,"previous_names":["tam7t/dolan"],"tags_count":6,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tam7t%2Fdroplan","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tam7t%2Fdroplan/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tam7t%2Fdroplan/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tam7t%2Fdroplan/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/tam7t","download_url":"https://codeload.github.com/tam7t/droplan/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":228004683,"owners_count":17854871,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["digitalocean","iptables"],"created_at":"2024-08-02T02:00:22.986Z","updated_at":"2024-12-03T21:34:03.800Z","avatar_url":"https://github.com/tam7t.png","language":"Go","funding_links":[],"categories":["Community OSS projects"],"sub_categories":[],"readme":"# droplan [![Build Status](http://img.shields.io/travis/tam7t/droplan.svg?style=flat-square)](https://travis-ci.org/tam7t/droplan) [![Gitter](https://img.shields.io/gitter/room/tam7t/droplan.js.svg?style=flat-square)](https://gitter.im/tam7t/droplan)\n\n## DigitalOcean Firewalls!\n\nExciting news! DigitalOcean now has a native firewall option that integrates well with tagging. Please consider using that instead of `droplan`!\n\nhttps://blog.digitalocean.com/cloud-firewalls-secure-droplets-by-default/\n\n## About\n\nThis utility helps secure the network interfaces on DigitalOcean droplets by\nadding `iptable` rules that only allow traffic from your other droplets. `droplan`\nqueries the DigitalOcean API and automatically updates `iptable` rules.\n\n## Installation\n\nThe latest release is available on the github [release page](https://github.com/tam7t/droplan/releases).\n\nYou can setup a cron job to run every 5 minutes in `/etc/cron.d`\n\n```\n*/5 * * * * root PATH=/sbin DO_KEY=READONLY_KEY /usr/local/bin/droplan \u003e/var/log/droplan.log 2\u003e\u00261\n```\n\n## Usage\n\n```\nDO_KEY=\u003cread_only_api_token\u003e /path/to/droplan\n```\n\nThe `iptables` rules added by `droplan` are equivalent to:\n\n```\n-N droplan-peers # create a new chain\n-A INPUT -i eth1 -j droplan-peers # add chain to private interface\n-A INPUT -i eth1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT\n-A INPUT -i eth1 -j DROP # add default DROP rule to private interface\n-A droplan-peers -s \u003cPEER\u003e/32 -j ACCEPT # allow traffic from PEER ip address\n```\n\n### Tags\nAccess can be limited to a subset of droplets using [tags](https://developers.digitalocean.com/documentation/v2/#tags).\nThe `DO_TAG` environment variable tells `droplan` to only allow access to\ndroplets with the specified tag.\n\n### Public Interface\nAdd the `PUBLIC=true` environment variable and `droplan` will maintain an\niptables chain of `droplan-peers-public` with the public ip addresses of\npeers and add a default drop rule to the `eth0` interface.\n\n**NOTE:** This will prevent you from being able to directly ssh into your droplet.\n\n## Development\n\n### Dependencies\n\nDependencies are vendored with [govendor](https://github.com/kardianos/govendor).\n\n### Build\n\nA `Makefile` is included:\n  * `test` - runs unit tests\n  * `build` - builds `droplan` on the current platform\n  * `release` - builds releasable artifacts\n\n\n## Docker image:\n\nWe provide a prebuilt [docker image][1]\n\nExample usage:\n\n```sh\ndocker run -d --restart=always --net=host --cap-add=NET_ADMIN -e DO_KEY=$your_digitalocean_api_key -e DO_INTERVAL=300 tam7t/droplan\n```\n\n- `-d --restart=always` starts the container in the background and restarts it on error (and on reboot)\n- `--net=host` is required because we want to affect the host's firewall rules, not the container's\n- `--cap-add=NET_ADMIN` to allow changing the host's firewall rules\n- specify `-e DO_INTERVAL=300` to change the delay (in seconds) between droplan invocations (default: execute once and exit)\n- you have to specify your DigitalOcean API key (using `-e DO_KEY`)\n- you can add `-e PUBLIC=true` or `-e DO_TAG=tagname` as described above\n- To manually start droplan (i.e. skip the 5 minute delay between invocations), simply use `docker restart $container-name`\n\n\n[1]: https://hub.docker.com/r/tam7t/droplan/\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftam7t%2Fdroplan","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftam7t%2Fdroplan","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftam7t%2Fdroplan/lists"}