Feature 57 (config and provisioning): modules declare config and provisions, their files rendered from templates; synced with main (issues of feature 57, 874)

modules/nftables/module.json

@@ -37,14 +37,14 @@
       "id": "unit",
       "type": "file",
       "path": "/etc/systemd/system/mesh-filter.service",
-      "content": "[Unit]\nDescription=The mesh's packet filter, derived from what is assigned to this node\nWants=network-pre.target\nBefore=network-pre.target\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=nft -f /etc/nftables.conf\nExecReload=nft -f /etc/nftables.conf\nExecStop=nft delete table inet mesh\n\n[Install]\nWantedBy=multi-user.target\n",
+      "template": "files/mesh-filter.service",
       "mode": "0644"
     },
     {
       "id": "stock-unit-stop",
       "type": "file",
       "path": "/etc/systemd/system/nftables.service.d/mesh.conf",
-      "content": "# The mesh: stopping the stock unit deletes only the mesh's table, never the whole ruleset\n# (novox/hq ADR 0100) — a flush would take the container runtime's rules and any firewall with it.\n[Service]\nExecStop=\nExecStop=nft delete table inet mesh\n",
+      "template": "files/mesh.conf",
       "mode": "0644"
     },
     {
@@ -80,6 +80,11 @@
         "entrypoints": [
           "tools/index.js"
         ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
       }
     ]
   }