open ports for domain node syncing in firewall

[DaMandal0rian]

PR Type

Enhancement

---

Description

• Add ingress rule for TCP port 30333 for VPC

• Add ingress rule for TCP port 30433 for VPC

• Add ingress rule for TCP port 30334 for VPC

---

Changes walkthrough 📝

	Relevant files
Enhancement	network.tf New ingress rules for node syncing ports                                  templates/terraform/subql/base/network.tf Added three ingress blocks for new node syncing ports Configured TCP ports 30333, 30433, and 30334 +24/-0

---

Need help?

Type /help how to ... in the comments thread for any questions about PR-Agent usage.

Check out the documentation for more information.

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪

🧪 No relevant tests

🔒 Security concerns The configuration allows ingress from any IP address due to the use of "0.0.0.0/0". If this exposure is not deliberate, consider limiting the CIDR blocks to trusted networks.

⚡ Recommended focus areas for review Security The new ingress rules permit traffic from "0.0.0.0/0", potentially exposing these ports to the public internet. Please verify if this is intentional or if restricting to a specific VPC CIDR range would be more secure. from_port = 22 to_port = 22 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } ingress { description = "TCP Node Port 30333 for VPC" from_port = 30333 to_port = 30333 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } ingress { description = "TCP Node Port 30433 for VPC" from_port = 30433 to_port = 30433 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } ingress { description = "TCP Node Port 30334 for VPC" from_port = 30334 to_port = 30334 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } egress { description = "egress for VPC" from_port = 0

[github-actions]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
Security	Limit ingress CIDR exposure Restrict ingress CIDR ranges to trusted networks instead of using "0.0.0.0/0" to minimize exposure. templates/terraform/subql/base/network.tf [98-104] ingress { description = "TCP Node Port 30333 for VPC" from_port = 30333 to_port = 30333 protocol = "tcp" - cidr_blocks = ["0.0.0.0/0"] + cidr_blocks = ["<trusted_network_cidr>"] } Suggestion importance[1-10]: 8 __ Why: The suggestion addresses a security concern by proposing to replace the overly permissive "0.0.0.0/0" with a more restrictive CIDR, which helps minimize exposure. However, the use of a placeholder requires further contextual adjustment, so the score is high but not perfect.	Medium

[DaMandal0rian]

This is not needed the ports only need egress