emperor.ini

[uwsgi]
ini = /etc/uwsgi/local.ini
; disable strict mode, otherwise the previous ini will not work
;strict = true
master = true
; we run under upstart
die-on-term = true
; logging
logto = /var/log/uwsgi/emperor.log
log-backupname = /var/log/uwsgi/emperor.log.old
; 100 megs, then rotate
log-maxsize = 100000000


auto-procname = true
procname-prefix-spaced = [[uwsgi.it/EMPEROR]]

emperor = /etc/uwsgi/services

; firewall chains 

; fastrouter_out (policy ACCEPT)
hook-as-root = exec:iptables -N fastrouter_out || true
hook-as-root = exec:iptables -F fastrouter_out
hook-as-root = exec:iptables -A fastrouter_out -j ACCEPT
hook-as-root = exec:iptables -A FORWARD -s 10.0.0.0/8 -p tcp --dport 1999 -j fastrouter_out

; fastrouter_in (policy DROP)
hook-as-root = exec:iptables -N fastrouter_in || true
hook-as-root = exec:iptables -F fastrouter_in
hook-as-root = exec:iptables -A fastrouter_in -j DROP
hook-as-root = exec:iptables -A INPUT -d %(public_ip) -p tcp --dport 1999 -j fastrouter_in

; tuntap (policy DROP)
hook-as-root = exec:iptables -N tuntap || true
hook-as-root = exec:iptables -F tuntap
hook-as-root = exec:iptables -A tuntap -j DROP
hook-as-root = exec:iptables -A INPUT -d %(public_ip) -p udp --dport 999 -j tuntap

; legion (policy DROP)
hook-as-root = exec:iptables -N legion || true
hook-as-root = exec:iptables -F legion
hook-as-root = exec:iptables -A legion -j DROP
hook-as-root = exec:iptables -A INPUT -d %(public_ip) -p udp --dport 2000 -j legion

; subscription (policy DROP)
hook-as-root = exec:iptables -N subscription || true
hook-as-root = exec:iptables -F subscription
hook-as-root = exec:iptables -A subscription -j DROP
hook-as-root = exec:iptables -A INPUT -d %(public_ip) -p udp --dport 3022 -j subscription