add audit

2026-10-28 15:57:54 -06:00
parent 9b9f1d5fdd
commit 842225fd40
6 changed files with 614 additions and 10 deletions
@@ -67,3 +67,11 @@ To make your own repository work as a sibling project, see [skills/sibling-proje
 ## Firewall

 firewalld blocks incoming connections except for the services and ports listed in [firewall.conf](firewall.conf) and in each sibling project's own `firewall.conf`. Each `update` opens anything newly listed, and closes ports MiniServer opened that nothing lists any more, for example after `sibling remove`. Rules you add yourself with `firewall-cmd` are left alone.
+
+To see what's actually open:
+
+```
+audit
+```
+
+It lists every port something on the server is listening on, whatever installed it, along with who can reach it (this machine only, the LAN, Tailscale or containers) and the service behind it. Each port the LAN can reach is marked with the `firewall.conf` that asks for it, or `[in no firewall.conf]` if it was opened some other way. Ports Docker containers publish are shown as reachable whatever firewalld says, because Docker opens them itself. You can stop or start the services from the list; one you stop stays off, through `update` and `refresh` too, until you start it again in `audit`. `audit --list` only shows the ports.