Feature 57 (config and provisioning): modules declare config and provisions, their files rendered from templates; synced with main (issues of feature 57, 874)

2026-10-16 07:37:43 +00:00
parent 1a2c917abf
commit 9652b2d5ce
771 changed files with 52063 additions and 1774 deletions
@@ -0,0 +1,14 @@
+[Unit]
+Description=The mesh's packet filter, derived from what is assigned to this node
+Wants=network-pre.target
+Before=network-pre.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=nft -f /etc/nftables.conf
+ExecReload=nft -f /etc/nftables.conf
+ExecStop=nft delete table inet mesh
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,5 @@
+# The mesh: stopping the stock unit deletes only the mesh's table, never the whole ruleset
+# (novox/hq ADR 0100) — a flush would take the container runtime's rules and any firewall with it.
+[Service]
+ExecStop=
+ExecStop=nft delete table inet mesh