Skip to content

Commit 5a78649

Browse files
author
Ankush
committed
Add comprehensive analysis and documentation files
0 parents  commit 5a78649

2,137 files changed

Lines changed: 1157817 additions & 0 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.devcontainer/Dockerfile‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
FROM node:20
2+
3+
ARG TZ
4+
ENV TZ="$TZ"
5+
6+
# Install basic development tools, Python, and iptables/ipset
7+
RUN apt update && apt install -y less \
8+
git \
9+
procps \
10+
sudo \
11+
fzf \
12+
zsh \
13+
man-db \
14+
unzip \
15+
gnupg2 \
16+
gh \
17+
iptables \
18+
ipset \
19+
iproute2 \
20+
dnsutils \
21+
aggregate \
22+
jq \
23+
python3 \
24+
python3-pip \
25+
python3-venv \
26+
python3-dev
27+
28+
# Ensure default node user has access to /usr/local/share
29+
RUN mkdir -p /usr/local/share/npm-global && \
30+
chown -R node:node /usr/local/share
31+
32+
ARG USERNAME=node
33+
34+
# Persist bash history.
35+
RUN SNIPPET="export PROMPT_COMMAND='history -a' && export HISTFILE=/commandhistory/.bash_history" \
36+
&& mkdir /commandhistory \
37+
&& touch /commandhistory/.bash_history \
38+
&& chown -R $USERNAME /commandhistory
39+
40+
# Set `DEVCONTAINER` environment variable to help with orientation
41+
ENV DEVCONTAINER=true
42+
43+
# Create workspace and config directories and set permissions
44+
RUN mkdir -p /workspace /home/node/.claude && \
45+
chown -R node:node /workspace /home/node/.claude
46+
47+
WORKDIR /workspace
48+
49+
RUN ARCH=$(dpkg --print-architecture) && \
50+
wget "https://github.com/dandavison/delta/releases/download/0.18.2/git-delta_0.18.2_${ARCH}.deb" && \
51+
sudo dpkg -i "git-delta_0.18.2_${ARCH}.deb" && \
52+
rm "git-delta_0.18.2_${ARCH}.deb"
53+
54+
# Set up non-root user
55+
USER node
56+
57+
# Install global packages
58+
ENV NPM_CONFIG_PREFIX=/usr/local/share/npm-global
59+
ENV PATH=$PATH:/usr/local/share/npm-global/bin
60+
61+
# Set the default shell to zsh rather than sh
62+
ENV SHELL=/bin/zsh
63+
64+
# Default powerline10k theme
65+
RUN sh -c "$(wget -O- https://github.com/deluan/zsh-in-docker/releases/download/v1.2.0/zsh-in-docker.sh)" -- \
66+
-p git \
67+
-p fzf \
68+
-a "source /usr/share/doc/fzf/examples/key-bindings.zsh" \
69+
-a "source /usr/share/doc/fzf/examples/completion.zsh" \
70+
-a "export PROMPT_COMMAND='history -a' && export HISTFILE=/commandhistory/.bash_history" \
71+
-x
72+
73+
# Install Claude
74+
RUN npm install -g @anthropic-ai/claude-code
75+
76+
# Copy and set up firewall script
77+
COPY init-firewall.sh /usr/local/bin/
78+
USER root
79+
RUN chmod +x /usr/local/bin/init-firewall.sh && \
80+
echo "node ALL=(root) NOPASSWD: /usr/local/bin/init-firewall.sh" > /etc/sudoers.d/node-firewall && \
81+
chmod 0440 /etc/sudoers.d/node-firewall
82+
USER node

‎.devcontainer/devcontainer.json‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{
2+
"name": "n8n Workflows - Claude Code",
3+
"build": {
4+
"dockerfile": "Dockerfile",
5+
"args": {
6+
"TZ": "${localEnv:TZ:America/Los_Angeles}"
7+
}
8+
},
9+
"runArgs": [
10+
"--cap-add=NET_ADMIN",
11+
"--cap-add=NET_RAW"
12+
],
13+
"customizations": {
14+
"vscode": {
15+
"extensions": [
16+
"dbaeumer.vscode-eslint",
17+
"esbenp.prettier-vscode",
18+
"eamodio.gitlens",
19+
"ms-python.python",
20+
"ms-python.flake8",
21+
"ms-python.black-formatter",
22+
"tamasfe.even-better-toml"
23+
],
24+
"settings": {
25+
"editor.formatOnSave": true,
26+
"editor.defaultFormatter": "esbenp.prettier-vscode",
27+
"editor.codeActionsOnSave": {
28+
"source.fixAll.eslint": "explicit"
29+
},
30+
"python.defaultInterpreterPath": "/usr/local/bin/python3",
31+
"python.linting.enabled": true,
32+
"python.linting.flake8Enabled": true,
33+
"[python]": {
34+
"editor.defaultFormatter": "ms-python.black-formatter"
35+
},
36+
"terminal.integrated.defaultProfile.linux": "zsh",
37+
"terminal.integrated.profiles.linux": {
38+
"bash": {
39+
"path": "bash",
40+
"icon": "terminal-bash"
41+
},
42+
"zsh": {
43+
"path": "zsh"
44+
}
45+
}
46+
}
47+
}
48+
},
49+
"remoteUser": "node",
50+
"mounts": [
51+
"source=claude-code-bashhistory,target=/commandhistory,type=volume",
52+
"source=claude-code-config,target=/home/node/.claude,type=volume"
53+
],
54+
"remoteEnv": {
55+
"NODE_OPTIONS": "--max-old-space-size=4096",
56+
"CLAUDE_CONFIG_DIR": "/home/node/.claude",
57+
"POWERLEVEL9K_DISABLE_GITSTATUS": "true"
58+
},
59+
"workspaceMount": "source=${localWorkspaceFolder},target=/workspace,type=bind,consistency=delegated",
60+
"workspaceFolder": "/workspace",
61+
"postCreateCommand": "sudo /usr/local/bin/init-firewall.sh"
62+
}

‎.devcontainer/init-firewall.sh‎

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,118 @@
1+
#!/bin/bash
2+
set -euo pipefail # Exit on error, undefined vars, and pipeline failures
3+
IFS=$'\n\t' # Stricter word splitting
4+
5+
# Flush existing rules and delete existing ipsets
6+
iptables -F
7+
iptables -X
8+
iptables -t nat -F
9+
iptables -t nat -X
10+
iptables -t mangle -F
11+
iptables -t mangle -X
12+
ipset destroy allowed-domains 2>/dev/null || true
13+
14+
# First allow DNS and localhost before any restrictions
15+
# Allow outbound DNS
16+
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
17+
# Allow inbound DNS responses
18+
iptables -A INPUT -p udp --sport 53 -j ACCEPT
19+
# Allow outbound SSH
20+
iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT
21+
# Allow inbound SSH responses
22+
iptables -A INPUT -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
23+
# Allow localhost
24+
iptables -A INPUT -i lo -j ACCEPT
25+
iptables -A OUTPUT -o lo -j ACCEPT
26+
27+
# Create ipset with CIDR support
28+
ipset create allowed-domains hash:net
29+
30+
# Fetch GitHub meta information and aggregate + add their IP ranges
31+
echo "Fetching GitHub IP ranges..."
32+
gh_ranges=$(curl -s https://api.github.com/meta)
33+
if [ -z "$gh_ranges" ]; then
34+
echo "ERROR: Failed to fetch GitHub IP ranges"
35+
exit 1
36+
fi
37+
38+
if ! echo "$gh_ranges" | jq -e '.web and .api and .git' >/dev/null; then
39+
echo "ERROR: GitHub API response missing required fields"
40+
exit 1
41+
fi
42+
43+
echo "Processing GitHub IPs..."
44+
while read -r cidr; do
45+
if [[ ! "$cidr" =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/[0-9]{1,2}$ ]]; then
46+
echo "ERROR: Invalid CIDR range from GitHub meta: $cidr"
47+
exit 1
48+
fi
49+
echo "Adding GitHub range $cidr"
50+
ipset add allowed-domains "$cidr"
51+
done < <(echo "$gh_ranges" | jq -r '(.web + .api + .git)[]' | aggregate -q)
52+
53+
# Resolve and add other allowed domains
54+
for domain in \
55+
"registry.npmjs.org" \
56+
"api.anthropic.com" \
57+
"sentry.io" \
58+
"statsig.anthropic.com" \
59+
"statsig.com"; do
60+
echo "Resolving $domain..."
61+
ips=$(dig +short A "$domain")
62+
if [ -z "$ips" ]; then
63+
echo "ERROR: Failed to resolve $domain"
64+
exit 1
65+
fi
66+
67+
while read -r ip; do
68+
if [[ ! "$ip" =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
69+
echo "ERROR: Invalid IP from DNS for $domain: $ip"
70+
exit 1
71+
fi
72+
echo "Adding $ip for $domain"
73+
ipset add allowed-domains "$ip"
74+
done < <(echo "$ips")
75+
done
76+
77+
# Get host IP from default route
78+
HOST_IP=$(ip route | grep default | cut -d" " -f3)
79+
if [ -z "$HOST_IP" ]; then
80+
echo "ERROR: Failed to detect host IP"
81+
exit 1
82+
fi
83+
84+
HOST_NETWORK=$(echo "$HOST_IP" | sed "s/\.[0-9]*$/.0\/24/")
85+
echo "Host network detected as: $HOST_NETWORK"
86+
87+
# Set up remaining iptables rules
88+
iptables -A INPUT -s "$HOST_NETWORK" -j ACCEPT
89+
iptables -A OUTPUT -d "$HOST_NETWORK" -j ACCEPT
90+
91+
# Set default policies to DROP first
92+
iptables -P INPUT DROP
93+
iptables -P FORWARD DROP
94+
iptables -P OUTPUT DROP
95+
96+
# First allow established connections for already approved traffic
97+
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
98+
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
99+
100+
# Then allow only specific outbound traffic to allowed domains
101+
iptables -A OUTPUT -m set --match-set allowed-domains dst -j ACCEPT
102+
103+
echo "Firewall configuration complete"
104+
echo "Verifying firewall rules..."
105+
if curl --connect-timeout 5 https://example.com >/dev/null 2>&1; then
106+
echo "ERROR: Firewall verification failed - was able to reach https://example.com"
107+
exit 1
108+
else
109+
echo "Firewall verification passed - unable to reach https://example.com as expected"
110+
fi
111+
112+
# Verify GitHub API access
113+
if ! curl --connect-timeout 5 https://api.github.com/zen >/dev/null 2>&1; then
114+
echo "ERROR: Firewall verification failed - unable to reach https://api.github.com"
115+
exit 1
116+
else
117+
echo "Firewall verification passed - able to reach https://api.github.com as expected"
118+
fi

‎.dockerignore‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
# .dockerignore - Files and directories to exclude from Docker build context
2+
3+
# Git
4+
.git
5+
.gitignore
6+
.gitmodules
7+
.github/
8+
9+
# Documentation
10+
*.md
11+
!README.md
12+
docs/
13+
Documentation/
14+
15+
# IDE and editor files
16+
.vscode/
17+
.idea/
18+
*.swp
19+
*.swo
20+
*~
21+
22+
# OS generated files
23+
.DS_Store
24+
Thumbs.db
25+
desktop.ini
26+
27+
# Python artifacts
28+
__pycache__/
29+
*.py[cod]
30+
*$py.class
31+
*.so
32+
.Python
33+
build/
34+
develop-eggs/
35+
dist/
36+
downloads/
37+
eggs/
38+
.eggs/
39+
lib/
40+
lib64/
41+
parts/
42+
sdist/
43+
var/
44+
wheels/
45+
*.egg-info/
46+
.installed.cfg
47+
*.egg
48+
49+
# Virtual environments
50+
venv/
51+
.venv/
52+
env/
53+
ENV/
54+
env.bak/
55+
venv.bak/
56+
57+
# Testing
58+
.pytest_cache/
59+
.coverage
60+
htmlcov/
61+
.tox/
62+
*.cover
63+
.hypothesis/
64+
test_*.py
65+
*_test.py
66+
tests/
67+
68+
# Database files (will be created at runtime)
69+
*.db
70+
*.sqlite
71+
*.sqlite3
72+
database/*.db
73+
database/*.db-*
74+
75+
# Backup directories
76+
workflows_backup*/
77+
backup/
78+
*.bak
79+
*.backup
80+
81+
# Environment files (security)
82+
.env
83+
.env.*
84+
!.env.example
85+
86+
# Logs
87+
*.log
88+
logs/
89+
90+
# Temporary files
91+
tmp/
92+
temp/
93+
*.tmp
94+
*.temp
95+
.cache/
96+
97+
# Development files
98+
DEBUG_*
99+
COMPREHENSIVE_*
100+
WORKFLOW_*
101+
FINAL_*
102+
test_*.sh
103+
scripts/
104+
105+
# Security scan files
106+
.trivyignore
107+
trivy-results.sarif
108+
.snyk
109+
110+
# CI/CD
111+
.travis.yml
112+
.gitlab-ci.yml
113+
azure-pipelines.yml
114+
115+
# Docker files (if building from within container)
116+
Dockerfile*
117+
docker-compose*.yml
118+
119+
# Node (if any)
120+
node_modules/
121+
npm-debug.log*
122+
yarn-debug.log*
123+
yarn-error.log*

0 commit comments

Comments
 (0)