tenseleyflow/shithub / eb28d6f

+# The role creates shithub-actions on shact0 (172.30.0.1/24), runs

+# dnsmasq on that bridge, and enforces direct-IP egress denial with

+# shithub-runner-firewall.service.

+shithub_runner_network: shithub-actions

+shithub_runner_network_bridge: shact0

+shithub_runner_network_subnet: 172.30.0.0/24

+shithub_runner_network_gateway: 172.30.0.1

+shithub_runner_dns_servers:

+  - "{{ shithub_runner_network_gateway }}"

+shithub_runner_dnsmasq_config: /etc/dnsmasq.d/shithubd-runner.conf

+shithub_runner_ipset_name: shithub_actions_allowed

+shithub_runner_firewall_script: /usr/local/sbin/shithub-runner-firewall

+- name: restart dnsmasq

+  systemd: { name: dnsmasq, state: restarted, enabled: yes }

+

+- name: restart shithub-runner-firewall

+  systemd: { name: shithub-runner-firewall, state: restarted, enabled: yes, daemon_reload: yes }

+

+- name: Runner Docker bridge name fits Linux interface limit

+  assert:

+    that:

+      - (shithub_runner_network_bridge | string | length) <= 15

+    fail_msg: >-

+      shithub_runner_network_bridge must be 15 characters or fewer because

+      Linux interface names are capped by IFNAMSIZ.

+

+- name: Runner network firewall packages

+  apt:

+    name:

+      - dnsmasq

+      - ipset

+      - iptables

+    state: present

+    update_cache: yes

+  when: shithub_runner_engine == "docker"

+

+- name: Inspect Actions Docker network

+  command: "{{ shithub_runner_engine }} network inspect {{ shithub_runner_network }}"

+  register: shithub_runner_network_inspect

+  failed_when: shithub_runner_network_inspect.rc not in [0, 1]

+  changed_when: false

+  when: shithub_runner_engine == "docker" and not ansible_check_mode

+

+- name: Create Actions Docker network

+  command: >-

+    {{ shithub_runner_engine }} network create

+    --driver bridge

+    --subnet {{ shithub_runner_network_subnet }}

+    --gateway {{ shithub_runner_network_gateway }}

+    --opt com.docker.network.bridge.name={{ shithub_runner_network_bridge }}

+    {{ shithub_runner_network }}

+  when:

+    - shithub_runner_engine == "docker"

+    - not ansible_check_mode

+    - shithub_runner_network_inspect.rc == 1

+

+- name: Inspect Actions Docker network after converge

+  command: "{{ shithub_runner_engine }} network inspect {{ shithub_runner_network }}"

+  register: shithub_runner_network_final

+  changed_when: false

+  when: shithub_runner_engine == "docker" and not ansible_check_mode

+

+- name: Record Actions Docker network facts

+  set_fact:

+    shithub_runner_network_info: "{{ (shithub_runner_network_final.stdout | from_json)[0] }}"

+  when: shithub_runner_engine == "docker" and not ansible_check_mode

+

+- name: Actions Docker network matches runner firewall config

+  assert:

+    that:

+      - shithub_runner_network_info.Driver == "bridge"

+      - shithub_runner_network_info.Options["com.docker.network.bridge.name"] == shithub_runner_network_bridge

+      - shithub_runner_network_info.IPAM.Config[0].Subnet == shithub_runner_network_subnet

+      - shithub_runner_network_info.IPAM.Config[0].Gateway == shithub_runner_network_gateway

+    fail_msg: >-

+      Existing Docker network {{ shithub_runner_network }} does not match the

+      configured Actions subnet/gateway/bridge. Remove or rename the network

+      before re-running the role so firewall rules target the correct bridge.

+  when: shithub_runner_engine == "docker" and not ansible_check_mode

+

+    group: root

+    mode: "0644"

+  notify: restart dnsmasq

+

+- name: Runner firewall script

+  template:

+    src: "{{ playbook_dir }}/../runner-config/firewall.sh.j2"

+    dest: "{{ shithub_runner_firewall_script }}"

+    owner: root

+    group: root

+    mode: "0755"

+  notify: restart shithub-runner-firewall

+

+- name: Runner firewall systemd unit

+  copy:

+    src: "{{ playbook_dir }}/../systemd/shithub-runner-firewall.service"

+    dest: /etc/systemd/system/shithub-runner-firewall.service

+    mode: "0644"

+  notify: [daemon-reload, restart shithub-runner-firewall]

+

+- name: Enable + start runner firewall

+  systemd:

+    name: shithub-runner-firewall

+    state: started

+    enabled: yes

+    daemon_reload: yes

+

+- name: Enable + start runner dnsmasq

+  systemd: { name: dnsmasq, state: started, enabled: yes }

+`dnsmasq.conf.j2` is the runner DNS allowlist template. The Ansible

+role renders it to `/etc/dnsmasq.d/shithubd-runner.conf` from

+`shithub_runner_network_allowlist`, binds dnsmasq to the dedicated

+Actions Docker bridge, and points step containers at that resolver

+with `engine.dns_servers`.

+`firewall.sh.j2` is installed as `/usr/local/sbin/shithub-runner-firewall`

+and run by `shithub-runner-firewall.service`. It creates the ipset used

+by dnsmasq and rejects direct-IP egress from the Actions bridge unless

+the destination IP was populated by an allowlisted DNS response. DNS to

+the bridge resolver is the only DNS path allowed from step containers.

+# Managed by Ansible. DNS allowlist resolver for Actions runners.

+# Bound only to the dedicated Actions Docker bridge; dnsmasq inserts

+# successful allowlisted resolutions into the ipset enforced by

+# shithub-runner-firewall.service.

+interface={{ shithub_runner_network_bridge }}

+listen-address={{ shithub_runner_network_gateway }}

+bind-interfaces

+{% if shithub_runner_network_allowlist is string %}

+{% set allowlist = shithub_runner_network_allowlist.split(",") | map("trim") | list %}

+{% else %}

+{% set allowlist = shithub_runner_network_allowlist %}

+{% endif %}

+{% for pattern in allowlist %}

+ipset=/{{ host }}/{{ shithub_runner_ipset_name }}

+#!/bin/sh

+# Managed by Ansible. Enforces deny-by-default egress for the Actions bridge.

+set -eu

+

+IPSET="{{ shithub_runner_ipset_name }}"

+CHAIN="SHITHUB_ACTIONS_EGRESS"

+SUBNET="{{ shithub_runner_network_subnet }}"

+DNS="{{ shithub_runner_network_gateway }}"

+

+IPSET_BIN="${IPSET_BIN:-ipset}"

+IPTABLES="${IPTABLES:-iptables}"

+

+"$IPSET_BIN" create "$IPSET" hash:ip family inet timeout 86400 -exist

+

+"$IPTABLES" -w -N "$CHAIN" 2>/dev/null || true

+"$IPTABLES" -w -F "$CHAIN"

+"$IPTABLES" -w -A "$CHAIN" -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

+"$IPTABLES" -w -A "$CHAIN" -d "$DNS" -p udp --dport 53 -j ACCEPT

+"$IPTABLES" -w -A "$CHAIN" -d "$DNS" -p tcp --dport 53 -j ACCEPT

+"$IPTABLES" -w -A "$CHAIN" -m set --match-set "$IPSET" dst -j ACCEPT

+"$IPTABLES" -w -A "$CHAIN" -j REJECT

+

+while "$IPTABLES" -w -D FORWARD -s "$SUBNET" -j "$CHAIN" 2>/dev/null; do

+    :

+done

+"$IPTABLES" -w -I FORWARD 1 -s "$SUBNET" -j "$CHAIN"

+[Unit]

+Description=shithub Actions runner firewall

+After=network-online.target docker.service

+Wants=network-online.target

+Requires=docker.service

+Before=shithubd-runner.service

+

+[Service]

+Type=oneshot

+ExecStart=/usr/local/sbin/shithub-runner-firewall

+RemainAfterExit=yes

+

+[Install]

+WantedBy=multi-user.target

+After=network-online.target docker.service dnsmasq.service shithub-runner-firewall.service

+Requires=dnsmasq.service shithub-runner-firewall.service

+- Database migrations are current through `0055_workflow_job_secret_masks.sql`.

+  --workspace-root /var/lib/shithubd-runner/workspaces \

+  --network shithub-actions \

+  --dns-servers 172.30.0.1

+network = "shithub-actions"

+dns_servers = ["172.30.0.1"]

+The Ansible runner role creates the `shithub-actions` bridge, runs the

+allowlist resolver at `172.30.0.1`, and installs firewall rules that

+reject direct-IP egress from step containers. If you run the binary

+without the role, provision equivalent network controls before pointing

+workflows at the runner.

+

+fetch from an internal package registry. The role creates the

+`shithub-actions` Docker bridge at `172.30.0.1/24`, runs dnsmasq on

+that bridge, and sets `engine.dns_servers` to the bridge resolver by

+default.

+- creates the dedicated Actions Docker network and bridge

+- renders `/etc/dnsmasq.d/shithubd-runner.conf` from the network

+  allowlist and starts dnsmasq bound to the Actions bridge

+- installs `shithub-runner-firewall.service`, which rejects direct-IP

+  egress from step containers unless dnsmasq populated the destination

+  in the allowlist ipset

+- a workflow-level request for `permissions: {shithub-runner-root: write}`

+  still runs as `65534`; root opt-in is disabled in the shipped runner

+  config until a trusted-workflow policy exists

+Actions jobs, run dnsmasq bound to that bridge, and set

+The Ansible role now does this by default. The rendered dnsmasq config

+has no default upstream resolver; names not matching the allowlist fail

+DNS resolution.

+

+The firewall service closes the direct-IP bypass: containers on the

+Actions subnet may send DNS only to the bridge resolver, and other

+egress is allowed only when the destination IP is present in the

+dnsmasq-populated ipset. Keep the runner on a separate host from web