kyle/hermes-bot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Restrict the robot's service ports to the USB link

Browse Source 
Audio (4713), MCP (8765) and the face webhook (8766) are accepted only on usb0
from 10.55.0.1 and dropped on every other interface, Wi-Fi included. SSH is left
open on all interfaces for V2, by the owner's decision. Tested on the Pi with
throwaway listeners: 8765 answers over usb0 and is unreachable over Wi-Fi, while
a control port answers on both.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AFN8nRRCiDiMN7ChBpHJhs
This commit is contained in:
kyle
2026-10-04 21:07:38 -07:00
co-authored by Claude Sonnet 5.5
parent 69a93eeb2f
commit 2535344f3d
2 changed files with 9 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CONTEXT.md
+4 -2
View File
@@ -88,8 +88,10 @@ printed enclosure, speakers. Work until those arrive is limited to what the Pi,
## Next
1. Finish package 0b: nftables rewrite (accept 4713/8765 only on `usb0` from `10.55.0.1`), Wi-Fi-off
boot test, replug recovery, NixOS snippet in `host/nixos/`.
1. Finish package 0b: Wi-Fi-off boot test, replug recovery, serial login check, NixOS snippet in
`host/nixos/`, and make the firewall load at boot. A new Omarchy host with a GPU (runs the local
model "ornith") arrives this week: it needs only `host/omarchy/robot-usb-link.sh` and its SSH key
added to the Pi.
2. Audio (package 1; needs the `wm8960-soundcard` overlay and a reboot), camera (package 3), then
the rest of the packages in `HANDOFF.md`.