route-proxy: tell the proxy the private network's range

The proxy serves internal names only to requests from the private network and needs its range to know which those are (novox/hq issue 191).
2026-10-02 01:10:13 +02:00
16 changed files with 40 additions and 881 deletions
@@ -1,31 +0,0 @@
 # lab's runtime: the tool runtime, carrying this module's code, and the toolchain the lab's suite
 # builds the mesh with (novox/hq ADR 0172). It reaches the machine's virtualisation and container
 # runtime through their sockets, so what it raises is what a hand run on this machine raises.
 #
 # Every download is pinned by its checksum: an image that builds the mesh is the last place to take
 # whatever an upstream serves today.
 ARG BUILD_BASE
 ARG RUNTIME_BASE
 FROM ${BUILD_BASE} AS build
 WORKDIR /app/modules/lab
 COPY . .
 RUN node /app/node_modules/typescript/bin/tsc tools/index.ts tools/runs.ts \
      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
 FROM ${RUNTIME_BASE}
 RUN apt-get update \
 && apt-get install -y --no-install-recommends git make ca-certificates curl \
 && rm -rf /var/lib/apt/lists/*
 RUN curl -fsSL -o /tmp/go.tgz https://go.dev/dl/go1.26.8.linux-amd64.tar.gz \
 && echo "d0f743b33e8d8945e6b1f432edd15785c70507121d6e2a723b21285eddf8b57b  /tmp/go.tgz" | sha256sum -c - \
 && tar -C /usr/local -xzf /tmp/go.tgz && rm /tmp/go.tgz
 RUN curl -fsSL -o /usr/local/bin/incus https://github.com/lxc/incus/releases/download/v7.5.1/bin.linux.incus.x86_64 \
 && echo "7bd6223b369f4d693fcde695bd8549a73b5b3d403735329212483702aa22c179  /usr/local/bin/incus" | sha256sum -c - \
 && chmod 0755 /usr/local/bin/incus
 RUN curl -fsSL -o /tmp/docker.tgz https://download.docker.com/linux/static/stable/x86_64/docker-28.5.2.tgz \
 && echo "ea90cfd12e1eeb12aa1c971741adb8bd4ed88e2a574eaac13f5029a1dbc6300d  /tmp/docker.tgz" | sha256sum -c - \
 && tar -C /tmp -xzf /tmp/docker.tgz docker/docker && mv /tmp/docker/docker /usr/local/bin/docker && rm -rf /tmp/docker /tmp/docker.tgz
 ENV PATH=/usr/local/go/bin:$PATH
 COPY --from=build /app/modules/lab/dist /app/modules/lab/dist
 ENV MESH_TOOL_MODULES=/app/modules/lab/dist/tools/index.js
@@ -1,81 +0,0 @@
 {
  "module": "lab",
  "version": "1",
  "capabilities": [
    "container-runtime"
  ],
  "own-secrets": {
    "broker": "${dir:mesh-state}/broker"
  },
  "resources": [
    {
      "id": "mesh-state",
      "type": "directory",
      "mode": "0700",
      "place": "mesh"
    },
    {
      "id": "state",
      "type": "directory",
      "mode": "0700",
      "place": "."
    },
    {
      "id": "work",
      "type": "directory",
      "path": "/var/lib/mesh-lab-runs",
      "mode": "0700"
    },
    {
      "id": "runtime-env",
      "type": "file",
      "path": "${dir:state}/lab.env",
      "mode": "0600",
      "content": "MESH_LAB_FORGE=${setting:forge}\n"
    },
    {
      "id": "runtime",
      "type": "container",
      "name": "mesh-lab",
      "network": "host",
      "env-file": [
        "${dir:state}/lab.env"
      ],
      "volumes": [
        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
        "${dir:work}:${dir:work}",
        "/var/run/docker.sock:/var/run/docker.sock",
        "/var/lib/incus/unix.socket:/var/lib/incus/unix.socket"
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
        "MESH_LAB_WORK": "${dir:work}"
      },
      "restart-on": [
        "runtime-env"
      ],
      "artifact": "runtime"
    }
  ],
  "build": {
    "on": [
      {
        "arg": "BUILD_BASE",
        "module": "mesh-tools",
        "artifact": "build"
      },
      {
        "arg": "RUNTIME_BASE",
        "module": "mesh-tools",
        "artifact": "runtime"
      }
    ],
    "artifacts": [
      {
        "name": "runtime",
        "kind": "image",
        "from": "Dockerfile"
      }
    ]
  }
 }
@@ -1,9 +0,0 @@
 {
  "name": "@novox/module-lab",
  "version": "0.1.0",
  "description": "lab — the lab, as a module: runs beds against the forge's branches when the mesh asks (novox/hq ADR 0172).",
  "type": "module",
  "private": true,
  "dependencies": { "@novox/mesh-sdk": "^0.1.0" },
  "devDependencies": { "@types/node": "^22.0.0", "typescript": "^5.6.0" }
 }
@@ -1,86 +0,0 @@
 // lab's tools — the lab, as the mesh asks for it (novox/hq ADR 0172). They run on the machine the
 // lab is assigned to, and only there: a bed raises virtual machines on that machine's virtualisation.
 import { spawnSync } from "node:child_process";
 import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
 import { listRuns, readStatus, REPOSITORIES, running, start, stop, tail } from "./runs.js";
 export function getLabTools(env: NodeJS.ProcessEnv): ToolDefinition[] {
  const work = env.MESH_LAB_WORK ?? "/var/lib/mesh-lab-runs";
  const forge = (env.MESH_LAB_FORGE ?? "").replace(/\/+$/, "");
  return [
    {
      name: "lab_check",
      description: "Whether this machine can run the lab's beds: the lab's own check, against the forge's main branch.",
      input: {},
      run: async () => {
        if (!forge) return { ok: false, output: "the lab's forge is not set: settings for lab, {\"forge\": \"<url>\"}" };
        const dir = `${work}/check`;
        spawnSync("rm", ["-rf", dir]);
        const clone = spawnSync("git", ["clone", "--quiet", "--depth", "1", `${forge}/novox/mesh-lab.git`, dir], { encoding: "utf8" });
        if (clone.status !== 0) return { ok: false, output: clone.stderr };
        spawnSync("npm", ["ci", "--no-audit", "--no-fund", "--loglevel=error"], { cwd: dir, encoding: "utf8" });
        const check = spawnSync("node", ["--experimental-strip-types", "src/cli.ts", "check"], { cwd: dir, encoding: "utf8" });
        return { ok: check.status === 0, output: `${check.stdout}${check.stderr}`.trim() };
      },
    },
    {
      name: "lab_run",
      description:
        "Run the lab's beds against branches on the forge: fresh checkouts of every repository the lab builds, " +
        "side by side, then the suite on the named test files. Answers at once with the run's id; lab_status " +
        "and lab_log follow it. One run at a time.",
      input: {
        tests: { type: "string", description: "the bed test files, comma-separated, relative to mesh-lab (e.g. test/integration/mesh.test.ts)" },
        refs: {
          type: "string",
          description: `a JSON object of repository to branch, for any of ${REPOSITORIES.join(", ")}; the rest run main`,
        },
      },
      run: async (args) => {
        if (!forge) return { started: false, reason: "the lab's forge is not set: settings for lab, {\"forge\": \"<url>\"}" };
        const tests = String(args.tests ?? "").split(",").map((s) => s.trim()).filter(Boolean);
        if (tests.length === 0) return { started: false, reason: "name at least one bed test file" };
        let refs: Record<string, string> = {};
        if (args.refs) {
          try {
            refs = JSON.parse(String(args.refs)) as Record<string, string>;
          } catch {
            return { started: false, reason: "refs is not a JSON object of repository to branch" };
          }
        }
        const stranger = Object.keys(refs).filter((r) => !REPOSITORIES.includes(r));
        if (stranger.length > 0) return { started: false, reason: `the lab does not build ${stranger.join(", ")}` };
        const busy = running(work);
        if (busy) return { started: false, reason: `${busy.id} is still ${busy.state}; one run at a time`, running: busy };
        return { started: true, run: start(work, forge, tests, refs) };
      },
    },
    {
      name: "lab_status",
      description: "A run's state, the commits it tested and how it ended — or every run, newest first, when no id is given.",
      input: { id: { type: "string", description: "the run's id (optional)" } },
      run: async (args) => {
        if (args.id) return readStatus(work, String(args.id)) ?? { found: false, id: String(args.id) };
        return { runs: listRuns(work).slice(0, 10) };
      },
    },
    {
      name: "lab_log",
      description: "The last lines of a run's log.",
      input: {
        id: { type: "string", description: "the run's id" },
        lines: { type: "number", description: "how many lines from the end (default 200)" },
      },
      run: async (args) => ({ id: String(args.id), log: tail(work, String(args.id), Number(args.lines ?? 200)) }),
    },
    {
      name: "lab_stop",
      description: "Stop a run and everything it started.",
      input: { id: { type: "string", description: "the run's id" } },
      run: async (args) => stop(work, String(args.id)) ?? { found: false, id: String(args.id) },
    },
  ];
 }
 registerModuleTools("lab", (env) => getLabTools(env));
@@ -1,171 +0,0 @@
 // A lab run: fresh checkouts of the named branches, side by side, then the lab's suite on the named
 // beds (novox/hq ADR 0172).
 //
 // **A run is a detached script with its own process group**, so it outlives the tool call that started
 // it and `stop` ends everything it started. It writes what it is doing to a status file beside its log,
 // and that file is the whole of what the tools read back: a runtime that restarts mid-run still answers
 // for it, and says it was lost rather than pretending it is still going.
 import { spawn } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 /** The repositories a lab run checks out, side by side, as the lab expects its siblings. */
 export const REPOSITORIES = ["mesh-lab", "mesh-controller", "mesh-host", "mesh-catalog", "mesh-tools", "mesh-sdk"];
 export interface RunStatus {
  id: string;
  state: "checking-out" | "building" | "running" | "passed" | "failed" | "stopped" | "lost";
  started: string;
  ended?: string;
  tests: string[];
  refs: Record<string, string>;
  commits?: Record<string, string>;
  exit?: number;
  pid?: number;
 }
 export function runDir(work: string, id: string): string {
  return join(work, id);
 }
 function statusPath(work: string, id: string): string {
  return join(runDir(work, id), "status.json");
 }
 export function readStatus(work: string, id: string): RunStatus | undefined {
  try {
    const s = JSON.parse(readFileSync(statusPath(work, id), "utf8")) as RunStatus;
    // A run whose process is gone while its status still says it is going was lost — the runtime or
    // the machine restarted under it. Said, rather than left reading as running for ever.
    if (!["passed", "failed", "stopped", "lost"].includes(s.state) && s.pid && !alive(s.pid)) {
      s.state = "lost";
    }
    return s;
  } catch {
    return undefined;
  }
 }
 function alive(pid: number): boolean {
  try {
    process.kill(pid, 0);
    return true;
  } catch {
    return false;
  }
 }
 export function listRuns(work: string): RunStatus[] {
  if (!existsSync(work)) return [];
  return readdirSync(work)
    .filter((d) => d.startsWith("run-"))
    .map((id) => readStatus(work, id))
    .filter((s): s is RunStatus => !!s)
    .sort((a, b) => b.started.localeCompare(a.started));
 }
 /** The run still going, if any: one at a time, because two would contend for the same machine. */
 export function running(work: string): RunStatus | undefined {
  return listRuns(work).find((s) => !["passed", "failed", "stopped", "lost"].includes(s.state));
 }
 const shellQuote = (s: string) => `'${s.replace(/'/g, `'\\''`)}'`;
 /**
 * The script one run executes. Every step writes its state first, so a run that dies says where.
 *
 * The environment is the one the lab's README describes for a run against sibling checkouts, pointed
 * at this run's own tree, so what is built and claimed is exactly what was checked out.
 */
 export function script(work: string, id: string, forge: string, tests: string[], refs: Record<string, string>): string {
  const dir = runDir(work, id);
  const setState = (state: string) =>
    `node -e ${shellQuote(
      `const f=${JSON.stringify(join(dir, "status.json"))};const s=JSON.parse(require("fs").readFileSync(f,"utf8"));s.state=${JSON.stringify(state)};require("fs").writeFileSync(f,JSON.stringify(s,null,2))`,
    )}`;
  const clones = REPOSITORIES.map((repo) => {
    const ref = refs[repo] ?? "main";
    return [
      `git clone --quiet --depth 50 --branch ${shellQuote(ref)} ${shellQuote(`${forge}/novox/${repo}.git`)} ${shellQuote(join(dir, repo))}`,
      `echo "${repo} $(git -C ${shellQuote(join(dir, repo))} rev-parse HEAD)" >> ${shellQuote(join(dir, "commits.txt"))}`,
    ].join("\n");
  }).join("\n");
  const bin = join(dir, "bin");
  return `set -euo pipefail
 cd ${shellQuote(dir)}
 ${setState("checking-out")}
 ${clones}
 node -e ${shellQuote(
    `const fs=require("fs");const f=${JSON.stringify(join(dir, "status.json"))};const s=JSON.parse(fs.readFileSync(f,"utf8"));s.commits=Object.fromEntries(fs.readFileSync(${JSON.stringify(join(dir, "commits.txt"))},"utf8").trim().split("\\n").map(l=>l.split(" ")));fs.writeFileSync(f,JSON.stringify(s,null,2))`,
  )}
 ${setState("building")}
 for repo in mesh-sdk mesh-tools mesh-lab; do (cd ${shellQuote(dir)}/$repo && npm ci --no-audit --no-fund --loglevel=error); done
 (cd ${shellQuote(dir)}/mesh-sdk && npm run build --if-present)
 (cd ${shellQuote(dir)}/mesh-tools && npm run build --if-present)
 mkdir -p ${shellQuote(bin)}
 for p in postgres-provisioner objectstore-provisioner route-proxy; do
  (cd ${shellQuote(dir)}/mesh-controller && CGO_ENABLED=0 go build -o ${shellQuote(bin)}/$p ./examples/$p)
 done
 export MESH_LAB_HOST_BINARY=${shellQuote(join(dir, "mesh-host", "mesh-host"))}
 export MESH_LAB_BUNDLE=${shellQuote(join(dir, "mesh-host", "examples", "foundation-first-node-nats.lock"))}
 export MESH_LAB_MODULES=${shellQuote(join(dir, "mesh-controller", "examples", "modules"))}
 export MESH_LAB_BUILDER=${shellQuote(join(dir, "mesh-controller", "build", "mesh-builder"))}
 export MESH_LAB_BOOTSTRAP_BINARY=${shellQuote(join(dir, "mesh-host", "mesh-bootstrap"))}
 export MESH_LAB_CATALOG=${shellQuote(join(dir, "mesh-catalog", "modules"))}
 export MESH_LAB_PROVISIONER=${shellQuote(join(bin, "postgres-provisioner"))}
 export MESH_LAB_OBJECTSTORE_PROVISIONER=${shellQuote(join(bin, "objectstore-provisioner"))}
 export MESH_LAB_ROUTE_PROXY=${shellQuote(join(bin, "route-proxy"))}
 ${setState("running")}
 cd ${shellQuote(join(dir, "mesh-lab"))}
 node --experimental-strip-types src/cli.ts suite ${tests.map(shellQuote).join(" ")}
 `;
 }
 /** start begins a run and returns at once with its status. */
 export function start(work: string, forge: string, tests: string[], refs: Record<string, string>): RunStatus {
  const id = `run-${new Date().toISOString().replace(/[:.]/g, "-")}`;
  const dir = runDir(work, id);
  mkdirSync(dir, { recursive: true });
  const status: RunStatus = { id, state: "checking-out", started: new Date().toISOString(), tests, refs };
  writeFileSync(statusPath(work, id), JSON.stringify(status, null, 2));
  writeFileSync(join(dir, "run.sh"), script(work, id, forge, tests, refs), { mode: 0o700 });
  // The wrapper records how the run ended, then removes the checkouts and keeps the log and status: a
  // run's tree is its own, and the next run starts from fresh ones (novox/hq ADR 0172).
  const wrapper = `bash ${shellQuote(join(dir, "run.sh"))} > ${shellQuote(join(dir, "run.log"))} 2>&1; code=$?
 node -e ${shellQuote(
    `const f=${JSON.stringify(statusPath(work, id))};const s=JSON.parse(require("fs").readFileSync(f,"utf8"));if(s.state!=="stopped"){s.state=process.argv[1]==="0"?"passed":"failed"};s.exit=Number(process.argv[1]);s.ended=new Date().toISOString();require("fs").writeFileSync(f,JSON.stringify(s,null,2))`,
  )} "$code"
 cd ${shellQuote(dir)} && rm -rf ${REPOSITORIES.map(shellQuote).join(" ")} bin`;
  const child = spawn("bash", ["-c", wrapper], { detached: true, stdio: "ignore" });
  child.unref();
  status.pid = child.pid;
  writeFileSync(statusPath(work, id), JSON.stringify(status, null, 2));
  return status;
 }
 /** stop ends a run and everything it started, by its process group. */
 export function stop(work: string, id: string): RunStatus | undefined {
  const s = readStatus(work, id);
  if (!s || !s.pid) return s;
  if (["passed", "failed", "stopped", "lost"].includes(s.state)) return s;
  s.state = "stopped";
  writeFileSync(statusPath(work, id), JSON.stringify(s, null, 2));
  try {
    process.kill(-s.pid, "SIGTERM");
  } catch {
    // Already gone between the read and the kill.
  }
  return s;
 }
 /** tail is the last lines of a run's log. */
 export function tail(work: string, id: string, lines: number): string {
  try {
    const all = readFileSync(join(runDir(work, id), "run.log"), "utf8").split("\n");
    return all.slice(-Math.max(1, lines)).join("\n");
  } catch {
    return "";
  }
 }
@@ -1,12 +0,0 @@
 {
  "compilerOptions": {
    "target": "ES2022",
    "module": "NodeNext",
    "moduleResolution": "NodeNext",
    "strict": true,
    "esModuleInterop": true,
    "skipLibCheck": true,
    "noEmit": true
  },
  "include": ["tools/index.ts", "tools/runs.ts"]
 }
@@ -1,23 +0,0 @@
 # nftables' runtime: the tool runtime, carrying the packet filter's tools and the binaries they speak.
 #
 # Built from this module's own directory and nothing else (novox/hq ADR 0069). Two bases, named in
 # module.json's `build.on`: the image this is compiled in and the image it runs in.
 ARG BUILD_BASE
 ARG RUNTIME_BASE
 FROM ${BUILD_BASE} AS build
 WORKDIR /app/modules/nftables
 COPY . .
 RUN node /app/node_modules/typescript/bin/tsc client.ts tools/index.ts \
      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
 FROM ${RUNTIME_BASE}
 # The filter's own tools: nft for the machine's ruleset and the mesh's table, iptables for the
 # legacy filter and the tables iptables-nft manages — a predecessor's rules live there (ADR 0168).
 # The container runs on the machine's network with NET_ADMIN (ADR 0170), so these act on the
 # machine's packet filter, not on a namespace of their own.
 RUN apt-get update \
      && apt-get install -y --no-install-recommends nftables iptables \
      && rm -rf /var/lib/apt/lists/*
 COPY --from=build /app/modules/nftables/dist /app/modules/nftables/dist
 ENV MESH_TOOL_MODULES=/app/modules/nftables/dist/tools/index.js
@@ -1,211 +1,22 @@
-// The packet filter's own code, in the module (novox/hq ADR 0039). The mesh computes this node's
+// The firewall's own code, in the module (novox/hq ADR 0039). The mesh computes this node's whole
-// rule set from every module's `listens` and writes it to the filter file (ADR 0045); the module
+// rule set from every module's `listens` and writes it to /etc/nftables.conf (novox/hq ADR 0045);
-// loads it through its own unit. This code reads the filter back as the machine enforces it, reloads
+// the module loads it through its own mesh-filter unit, reloaded whenever the rules change, whose
-// the mesh's own table, and removes one thing the mesh did not write when the operator names it
+// stop deletes only the mesh's table and never flushes the whole ruleset (novox/hq ADR 0100). This
-// (ADR 0168, ADR 0170) — the seat's three verbs, over the machine's own tools.
+// code exists only to read back what is actually enforced — the enforcement itself is declarative.
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
-const execFileP = promisify(execFile);
+const run = promisify(execFile);
 /** A command runner, so the acts can be tested without a packet filter. */
 export type Runner = (cmd: string, args: string[]) => Promise<string>;
 export const execRunner: Runner = async (cmd, args) => {
  const { stdout } = await execFileP(cmd, args, { maxBuffer: 16 * 1024 * 1024 });
  return stdout;
 };
 /** The mesh's own tables, which `remove` never touches. */
 const MESH_TABLES = new Set(["inet mesh", "inet mesh_guard"]);
 /** The tables iptables-nft manages, spoken through iptables rather than nft. */
 const IPTABLES_TABLES = new Set(["filter", "nat", "raw", "mangle", "security"]);
 /** The chains the kernel has built in; flushing one is the owner's act, not an operator's removal. */
 const BUILT_IN = new Set(["INPUT", "FORWARD", "OUTPUT", "PREROUTING", "POSTROUTING"]);
 /** The chain the container runtime leaves for an administrator, which is emptied, never deleted. */
 const USER_CHAIN = "DOCKER-USER";
 export interface Removal {
  where: string;
  did: string[];
 }
 export class FirewallClient {
-  private readonly run: Runner;
+  static fromEnv(_env: NodeJS.ProcessEnv = process.env): FirewallClient {
-  private readonly filterFile: string;
+    return new FirewallClient();
  constructor(run: Runner = execRunner, filterFile: string = process.env.MESH_FILTER_FILE ?? "/etc/nftables.conf") {
    this.run = run;
    this.filterFile = filterFile;
  }
-  static fromEnv(env: NodeJS.ProcessEnv = process.env): FirewallClient {
+  /** The mesh's live table — exactly what is dropping and accepting on this node right now. */
    return new FirewallClient(execRunner, env.MESH_FILTER_FILE ?? "/etc/nftables.conf");
  }
  /** The mesh's live table — exactly what the mesh's own filter is dropping and accepting. */
  async ruleset(): Promise<string> {
-    return this.run("nft", ["list", "table", "inet", "mesh"]);
+    const { stdout } = await run("nft", ["list", "table", "inet", "mesh"]);
-  }
+    return stdout;
  /** The packet filter as the machine enforces it: nftables whole or narrowed, and the legacy filter's
   *  listings where the tools exist. */
  async rules(table?: string, chain?: string): Promise<{ nftables: string; legacy: Record<string, string> }> {
    let nftables: string;
    if (table && chain) {
      const [family, name] = splitTable(table);
      nftables = await this.run("nft", ["list", "chain", family, name, chain]);
    } else if (table) {
      const [family, name] = splitTable(table);
      nftables = await this.run("nft", ["list", "table", family, name]);
    } else {
      nftables = await this.run("nft", ["list", "ruleset"]);
    }
    const legacy: Record<string, string> = {};
    if (!table) {
      for (const tool of ["iptables-legacy", "ip6tables-legacy"]) {
        try {
          const out = await this.run(tool, ["-S"]);
          if (out.trim()) legacy[tool] = out;
        } catch {
          // the tool is not here, or the legacy filter is empty: nothing to list
  }
 }
    }
    return { nftables, legacy };
  }
  /** Load the mesh's own filter again from the file the mesh writes, and answer with the table. */
  async reload(): Promise<{ loaded: string; table: string }> {
    await this.run("nft", ["-f", this.filterFile]);
    return { loaded: this.filterFile, table: await this.ruleset() };
  }
  /** Whether the found front end is in force, whose chains `remove` leaves alone. */
  private async ufwActive(): Promise<boolean> {
    try {
      const out = await this.run("ufw", ["status"]);
      return /^Status:\s*active/m.test(out);
    } catch {
      return false;
    }
  }
  /** Remove one rule set the mesh did not write, named as the host reports it (ADR 0168). */
  async remove(where: string): Promise<Removal> {
    const did: string[] = [];
    const legacy = /^chain (\S+) \((iptables-legacy|ip6tables-legacy|iptables|ip6tables)\)$/.exec(where.trim());
    const nft = /^table (\S+) (\S+), chain (\S+)$/.exec(where.trim());
    if (legacy) {
      const [, chain, tool] = legacy;
      await this.refuseOwned(chain, "ip", "filter");
      await this.removeChainWith(tool, undefined, chain, did);
      return { where, did };
    }
    if (nft) {
      const [, family, name, chain] = nft;
      const table = `${family} ${name}`;
      if (MESH_TABLES.has(table)) throw new Error(`${where} is the mesh's own table; it is not removed, it is composed`);
      await this.refuseOwned(chain, family, name);
      if ((family === "ip" || family === "ip6") && IPTABLES_TABLES.has(name)) {
        const tool = family === "ip6" ? "ip6tables" : "iptables";
        await this.removeChainWith(tool, name, chain, did);
        return { where, did };
      }
      // A table of the machine's own: a chain of it goes, and the table with it when nothing is left.
      const listing = await this.run("nft", ["list", "table", family, name]);
      const base = new RegExp(`chain ${escape(chain)} \\{[^}]*type \\S+ hook`).test(listing);
      for (const from of chainsJumpingTo(listing, chain)) {
        await this.deleteNftRules(family, name, from, chain, did);
      }
      if (base) {
        await this.run("nft", ["flush", "chain", family, name, chain]);
        did.push(`nft flush chain ${family} ${name} ${chain}`);
      } else {
        await this.run("nft", ["delete", "chain", family, name, chain]);
        did.push(`nft delete chain ${family} ${name} ${chain}`);
      }
      return { where, did };
    }
    throw new Error(`${JSON.stringify(where)} is not a rule set as the host reports one: ` +
      "`chain X (iptables-legacy)` or `table <family> <name>, chain X`");
  }
  private async refuseOwned(chain: string, family: string, table: string): Promise<void> {
    if (chain !== USER_CHAIN && chain.startsWith("DOCKER")) {
      throw new Error(`chain ${chain} is the container runtime's own; it is left`);
    }
    if (BUILT_IN.has(chain)) {
      throw new Error(`chain ${chain} is built in; its policy is its owner's and it is not flushed`);
    }
    if (chain.startsWith("ufw") && (await this.ufwActive())) {
      throw new Error(`chain ${chain} belongs to the found firewall, which is in force; converge retires it`);
    }
    void family; void table;
  }
  /** Through an iptables tool: the user chain is emptied back to its one return; another chain loses
   *  the jumps into it, is flushed and deleted. */
  private async removeChainWith(tool: string, table: string | undefined, chain: string, did: string[]): Promise<void> {
    const t = table && table !== "filter" ? ["-t", table] : [];
    if (chain === USER_CHAIN) {
      await this.run(tool, [...t, "-F", chain]);
      await this.run(tool, [...t, "-A", chain, "-j", "RETURN"]);
      did.push(`${tool} ${[...t, "-F", chain].join(" ")}`, `${tool} ${[...t, "-A", chain, "-j", "RETURN"].join(" ")}`);
      return;
    }
    const listing = await this.run(tool, [...t, "-S"]);
    for (const line of listing.split("\n")) {
      const fields = line.trim().split(/\s+/);
      if (fields[0] !== "-A") continue;
      const j = fields.indexOf("-j");
      const g = fields.indexOf("-g");
      const target = j >= 0 ? fields[j + 1] : g >= 0 ? fields[g + 1] : "";
      if (target !== chain) continue;
      const args = [...t, "-D", ...fields.slice(1)];
      await this.run(tool, args);
      did.push(`${tool} ${args.join(" ")}`);
    }
    await this.run(tool, [...t, "-F", chain]);
    await this.run(tool, [...t, "-X", chain]);
    did.push(`${tool} ${[...t, "-F", chain].join(" ")}`, `${tool} ${[...t, "-X", chain].join(" ")}`);
  }
  private async deleteNftRules(family: string, name: string, from: string, target: string, did: string[]): Promise<void> {
    const listing = await this.run("nft", ["-a", "list", "chain", family, name, from]);
    for (const line of listing.split("\n")) {
      if (!new RegExp(`\\b(jump|goto) ${escape(target)}\\b`).test(line)) continue;
      const handle = /# handle (\d+)/.exec(line)?.[1];
      if (!handle) continue;
      await this.run("nft", ["delete", "rule", family, name, from, "handle", handle]);
      did.push(`nft delete rule ${family} ${name} ${from} handle ${handle}`);
    }
  }
 }
 function splitTable(table: string): [string, string] {
  const parts = table.trim().split(/\s+/);
  if (parts.length !== 2) throw new Error(`a table is \`family name\`, not ${JSON.stringify(table)}`);
  return [parts[0], parts[1]];
 }
 /** Which chains of a listed table jump or go to the named one. */
 export function chainsJumpingTo(listing: string, target: string): string[] {
  const out: string[] = [];
  let chain = "";
  for (const raw of listing.split("\n")) {
    const line = raw.trim();
    const head = /^chain (\S+) \{/.exec(line);
    if (head) { chain = head[1]; continue; }
    if (line === "}") { chain = ""; continue; }
    if (chain && chain !== target && new RegExp(`\\b(jump|goto) ${escape(target)}\\b`).test(line) && !out.includes(chain)) {
      out.push(chain);
    }
  }
  return out;
 }
 function escape(s: string): string {
  return s.replace(/[.*+?^${}()|[\]\\-]/g, "\\$&");
 }
@@ -2,30 +2,18 @@
  "module": "nftables",
  "version": "1",
  "capabilities": [
-    "firewall",
+    "firewall"
    "container-runtime"
  ],
  "claims": [
    {
      "name": "node-packet-filter",
-      "scope": "node",
+      "scope": "node"
      "serves": [
        "rules",
        "reload",
        "remove"
      ]
    }
  ],
  "filtering": {
    "into": "/etc/nftables.conf"
  },
  "resources": [
    {
      "id": "mesh-state",
      "type": "directory",
      "mode": "0700",
      "place": "mesh"
    },
    {
      "id": "package",
      "type": "package",
@@ -58,51 +46,6 @@
      "reload-on": [
        "filtering"
      ]
    },
    {
      "id": "runtime",
      "type": "container",
      "name": "mesh-nftables",
      "network": "host",
      "capabilities": [
        "NET_ADMIN"
      ],
      "volumes": [
        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
        "/etc/nftables.conf:/etc/nftables.conf:ro"
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
        "MESH_FILTER_FILE": "/etc/nftables.conf"
      },
      "artifact": "runtime"
    }
  ],
  "tools": [
    "firewall_rules"
  ],
  "own-secrets": {
    "broker": "${dir:mesh-state}/broker"
  },
  "build": {
    "on": [
      {
        "arg": "BUILD_BASE",
        "module": "mesh-tools",
        "artifact": "build"
      },
      {
        "arg": "RUNTIME_BASE",
        "module": "mesh-tools",
        "artifact": "runtime"
      }
    ],
    "artifacts": [
      {
        "name": "runtime",
        "kind": "image",
        "from": "Dockerfile"
    }
  ]
 }
 }
@@ -1,15 +1,11 @@
 {
-  "name": "@novox/module-nftables",
+  "name": "@novox/module-firewall",
  "version": "0.1.0",
-  "description": "nftables — loads the mesh's packet filter and holds the node-packet-filter seat: its verbs rules, reload and remove (novox/hq ADR 0045, ADR 0170).",
+  "description": "firewall — applies the mesh-computed packet filter (ADR 0045). Its diagnostic tool lives here.
  "type": "module",
  "private": true,
  "scripts": {
    "build": "tsc client.ts tools/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist",
    "test": "node --test --experimental-strip-types 'test/*.test.ts'"
  },
  "dependencies": {
-    "@novox/mesh-sdk": "^0.1.1"
+    "@novox/mesh-sdk": "^0.1.0"
  },
  "devDependencies": {
    "@types/node": "^22.0.0",
@@ -1,74 +0,0 @@
 // `remove` acts on one rule set the mesh did not write, named as the host reports it (novox/hq ADR
 // 0168, 0169), over the shapes two machines of the first mesh reported live: a predecessor's chain in
 // the legacy filter, the runtime's user chain in the IPv6 legacy filter, a leftover front-end chain,
 // and the same in an iptables-nft table. It refuses what is not the operator's to remove.
 import { test } from "node:test";
 import assert from "node:assert/strict";
 import { FirewallClient, chainsJumpingTo, type Runner } from "../client.ts";
 const legacy = [
  "-P INPUT ACCEPT", "-P FORWARD DROP", "-P OUTPUT ACCEPT",
  "-N DOCKER", "-N DOCKER-USER", "-N HAL-MESH-ONLY",
  "-A FORWARD -j DOCKER-USER",
  "-A DOCKER-USER -i enp6s0 -p tcp -m conntrack --ctstate NEW -j HAL-MESH-ONLY",
  "-A HAL-MESH-ONLY -m conntrack --ctorigdstport 80 -j RETURN",
  "-A HAL-MESH-ONLY -m comment --comment \"HAL: not public -> mesh only\" -j DROP",
 ].join("\n") + "\n";
 function fake(ufwActive = false): { run: Runner; asked: string[] } {
  const asked: string[] = [];
  const run: Runner = async (cmd, args) => {
    asked.push([cmd, ...args].join(" "));
    if (cmd === "ufw") return ufwActive ? "Status: active\n" : "Status: inactive\n";
    if (args.join(" ") === "-S") return legacy;
    if (cmd === "nft" && args[0] === "list" && args[1] === "table") {
      return "table ip6 own {\n\tchain forward {\n\t\ttype filter hook forward priority filter; policy accept;\n\t\tjump deny\n\t}\n\tchain deny {\n\t\tdrop\n\t}\n}\n";
    }
    if (cmd === "nft" && args[0] === "-a") {
      return "table ip6 own {\n\tchain forward {\n\t\ttype filter hook forward priority filter; policy accept;\n\t\tjump deny # handle 7\n\t}\n}\n";
    }
    return "";
  };
  return { run, asked };
 }
 test("a predecessor's chain in the legacy filter loses its jumps, is flushed and deleted", async () => {
  const f = fake();
  const out = await new FirewallClient(f.run).remove("chain HAL-MESH-ONLY (iptables-legacy)");
  assert.deepEqual(out.did, [
    "iptables-legacy -D DOCKER-USER -i enp6s0 -p tcp -m conntrack --ctstate NEW -j HAL-MESH-ONLY",
    "iptables-legacy -F HAL-MESH-ONLY",
    "iptables-legacy -X HAL-MESH-ONLY",
  ]);
 });
 test("the runtime's user chain is emptied back to its one return, never deleted", async () => {
  const f = fake();
  const out = await new FirewallClient(f.run).remove("chain DOCKER-USER (ip6tables-legacy)");
  assert.deepEqual(out.did, ["ip6tables-legacy -F DOCKER-USER", "ip6tables-legacy -A DOCKER-USER -j RETURN"]);
  const nft = await new FirewallClient(fake().run).remove("table ip6 filter, chain DOCKER-USER");
  assert.deepEqual(nft.did, ["ip6tables -F DOCKER-USER", "ip6tables -A DOCKER-USER -j RETURN"]);
 });
 test("a chain of the machine's own nftables table goes with the rules that reach it", async () => {
  const f = fake();
  const out = await new FirewallClient(f.run).remove("table ip6 own, chain deny");
  assert.deepEqual(out.did, ["nft delete rule ip6 own forward handle 7", "nft delete chain ip6 own deny"]);
 });
 test("what is not the operator's to remove is refused by name", async () => {
  const c = new FirewallClient(fake(true).run);
  await assert.rejects(c.remove("table inet mesh, chain forward"), /the mesh's own table/);
  await assert.rejects(c.remove("chain DOCKER (iptables-legacy)"), /container runtime's own/);
  await assert.rejects(c.remove("chain FORWARD (iptables-legacy)"), /built in/);
  await assert.rejects(c.remove("chain ufw6-docker-logging-deny (ip6tables-legacy)"), /found firewall, which is in force/);
  await assert.rejects(c.remove("something else"), /not a rule set as the host reports one/);
  // Retired, a front end's leftover is nobody's and goes.
  const retired = await new FirewallClient(fake(false).run).remove("chain ufw6-docker-logging-deny (ip6tables-legacy)");
  assert.ok(retired.did.includes("ip6tables-legacy -X ufw6-docker-logging-deny"));
 });
 test("which chains jump to a target is read from a listing", () => {
  const listing = "table ip6 own {\n\tchain a {\n\t\tjump deny\n\t}\n\tchain b {\n\t\tgoto deny\n\t}\n\tchain deny {\n\t\tdrop\n\t}\n}\n";
  assert.deepEqual(chainsJumpingTo(listing, "deny"), ["a", "b"]);
 });
@@ -1,51 +1,19 @@
-// The packet filter's tools: the node-packet-filter seat's three verbs — what the machine enforces,
+// firewall's tools — one, and the useful one: what is actually enforced. The rules are the mesh's,
-// reload the mesh's own, remove one thing the mesh did not write — and the module's own reading of
+// computed from every module's listens; this reads the live table so a declared scope can be checked
-// the mesh's table (novox/hq ADR 0045, ADR 0168, ADR 0170).
+// against what the packet filter is really doing.
 import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
 import { FirewallClient } from "../client.js";
 export function getSeatVerbs(firewall: FirewallClient): ToolDefinition[] {
  return [
    {
      name: "rules",
      description:
        "The packet filter as this machine enforces it now: the nftables ruleset and, where the tool exists, the legacy filter's listings. Narrowed to one table or chain when asked.",
      input: {
        table: { type: "string", description: "one nftables table, as `family name` (optional)" },
        chain: { type: "string", description: "one chain of that table (optional)" },
      },
      run: async (args) => firewall.rules(args.table ? String(args.table) : undefined, args.chain ? String(args.chain) : undefined),
    },
    {
      name: "reload",
      description: "Load the mesh's own filter again from the file the mesh writes, and answer with the mesh's table as loaded.",
      input: {},
      run: async () => firewall.reload(),
    },
    {
      name: "remove",
      description:
        "Remove one rule set the mesh did not write, named exactly as `node show` lists it: `chain X (iptables-legacy)` or `table ip6 filter, chain DOCKER-USER`. " +
        "Refuses the mesh's tables, the runtime's own chains, a built-in chain and an active found firewall's chains. An operator's act, by name, never a flush.",
      input: { where: { type: "string", description: "the rule set, as `node show` lists it" } },
      run: async (args) => firewall.remove(String(args.where ?? "")),
    },
  ];
 }
 export function getFirewallTools(firewall: FirewallClient): ToolDefinition[] {
  return [
    {
      name: "firewall_rules",
-      description: "The mesh's live nftables table on this node — what the mesh's own filter is accepting and dropping.",
+      description: "The mesh's live nftables rules on this node — what is actually accepting and dropping.",
      input: {},
      run: async () => ({ ruleset: await firewall.ruleset() }),
    },
  ];
 }
-const firewall = FirewallClient.fromEnv();
+registerModuleTools("firewall", () => getFirewallTools(FirewallClient.fromEnv()));
 // The seat's verbs under the seat's name: the runtime serves them on the seat's subjects where this
 // module holds it (ADR 0159, 0160). The module's own under its own.
 registerModuleTools("node-packet-filter", () => getSeatVerbs(firewall));
 registerModuleTools("nftables", () => getFirewallTools(firewall));
@@ -25,9 +25,6 @@
    "acme-ca": "${dir:state}/acme-ca.json",
    "internal-acme-ca": "${dir:state}/internal-acme-ca.json"
  },
  "own-secrets": {
    "broker": "${dir:mesh-state}/broker"
  },
  "listens": [
    {
      "name": "http",
@@ -51,12 +48,6 @@
      "mode": "0700",
      "place": "."
    },
    {
      "id": "mesh-state",
      "type": "directory",
      "mode": "0700",
      "place": "mesh"
    },
    {
      "id": "routes-dir",
      "type": "directory",
@@ -89,6 +80,13 @@
      "mode": "0600",
      "content": "INTERNAL_ACME_DIRECTORY=https://${bound:internal-acme-ca:at}:${bound:internal-acme-ca:port}${bound:internal-acme-ca:path}\nINTERNAL_ACME_ROOTS=https://${bound:internal-acme-ca:at}:${bound:internal-acme-ca:port}${bound:internal-acme-ca:roots}\nINTERNAL_ACME_ROOTS_PATH=${bound:internal-acme-ca:roots}\n"
    },
    {
      "id": "internal-sources-env",
      "type": "file",
      "path": "${dir:state}/internal-sources.env",
      "mode": "0600",
      "content": "INTERNAL_SOURCES=${machine:mesh-range}\n"
    },
    {
      "id": "trust",
      "type": "container",
@@ -141,13 +139,13 @@
      "network": "host",
      "env-file": [
        "${dir:state}/acme.env",
-        "${dir:state}/internal-acme.env"
+        "${dir:state}/internal-acme.env",
        "${dir:state}/internal-sources.env"
      ],
      "volumes": [
        "${dir:routes-dir}:/routes:ro",
        "${dir:acme-cache}:/acme",
-        "${dir:ca-dir}:/ca:ro",
+        "${dir:ca-dir}:/ca:ro"
        "${dir:mesh-state}/broker:/run/secrets/broker:ro"
      ],
      "env": {
        "ROUTES": "/routes/mesh.json",
@@ -155,14 +153,14 @@
        "TLS_LISTEN": ":443",
        "ACME_CACHE": "/acme",
        "ACME_CA_BUNDLE": "/ca/root.crt",
-        "INTERNAL_ACME_CA_BUNDLE": "/ca/internal-root.crt",
+        "INTERNAL_ACME_CA_BUNDLE": "/ca/internal-root.crt"
        "MESH_BROKER_FILE": "/run/secrets/broker"
      },
      "restart-on": [
        "trust",
        "acme-env",
        "internal-trust",
-        "internal-acme-env"
+        "internal-acme-env",
        "internal-sources-env"
      ]
    }
  ],
@@ -23,19 +23,6 @@ export interface UnifiPortForward {
  site_id?: string;
 }
 export interface UnifiNetwork {
  _id: string;
  name: string;
  purpose: string;
  ip_subnet?: string;
  dhcpd_enabled?: boolean;
  dhcpd_dns_enabled?: boolean;
  dhcpd_dns_1?: string;
  dhcpd_dns_2?: string;
  dhcpd_dns_3?: string;
  dhcpd_dns_4?: string;
 }
 export interface UnifiDevice {
  _id: string;
  name: string;
@@ -245,17 +232,6 @@ export class UnifiApiClient {
    await this.request<unknown>("DELETE", `/api/s/${this.site}/rest/portforward/${id}`);
  }
  // --- Networks ---
  async listNetworks(): Promise<UnifiNetwork[]> {
    return this.request<UnifiNetwork>("GET", `/api/s/${this.site}/rest/networkconf`);
  }
  async updateNetwork(id: string, fields: Partial<UnifiNetwork>): Promise<UnifiNetwork> {
    const result = await this.request<UnifiNetwork>("PUT", `/api/s/${this.site}/rest/networkconf/${id}`, fields);
    return result[0];
  }
  // --- Devices ---
  async listDevices(): Promise<UnifiDevice[]> {
@@ -1,23 +1,10 @@
 // unifi's tools — its own code (novox/hq ADR 0039), importing unifi's own client. They return
 // structured data; the mesh serves them through the sdk's tool harness. unifi is tools-only (no
 // events entrypoint): the controller does not push lifecycle events the mesh consumes, so this
-// module reads its resources — port forwards, networks, devices, clients — and exposes them, and stops there.
+// module reads its resources — port forwards, devices, clients — and exposes them, and stops there.
 import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
-import { UnifiApiClient, type UnifiNetwork, type UnifiPortForward } from "../client.js";
+import { UnifiApiClient, type UnifiPortForward } from "../client.js";
 function summarizeNetwork(n: UnifiNetwork): Record<string, unknown> {
  const dns = [n.dhcpd_dns_1, n.dhcpd_dns_2, n.dhcpd_dns_3, n.dhcpd_dns_4].filter((s): s is string => !!s);
  return {
    id: n._id,
    name: n.name,
    purpose: n.purpose,
    subnet: n.ip_subnet ?? null,
    dhcp: n.dhcpd_enabled ?? null,
    // What DHCP hands out as DNS: the listed servers when set, otherwise the gateway itself.
    dhcp_dns: n.dhcpd_dns_enabled ? dns : "the gateway",
  };
 }
 function summarizePortForward(r: UnifiPortForward): Record<string, unknown> {
  return {
@@ -101,40 +88,6 @@ export function getUnifiTools(unifi: UnifiApiClient): ToolDefinition[] {
        return { deleted: true, id: String(args.id) };
      },
    },
    {
      name: "unifi_list_networks",
      description: "List the networks the UniFi controller manages, with the DNS servers each one's DHCP hands out.",
      input: {},
      run: async () => {
        const nets = await unifi.listNetworks();
        return { count: nets.length, networks: nets.map(summarizeNetwork) };
      },
    },
    {
      name: "unifi_set_network_dns",
      description:
        "Set the DNS servers a network's DHCP hands out to its devices (see unifi_list_networks for ids). " +
        "Up to four addresses, comma-separated; \"gateway\" hands out the gateway itself. Devices pick it up when they renew.",
      input: {
        id: { type: "string", description: "the network id" },
        dns: { type: "string", description: "comma-separated DNS server addresses, or \"gateway\"" },
      },
      run: async (args) => {
        const asked = String(args.dns ?? "").trim();
        if (!asked) return { updated: false, reason: "say dns: addresses, or \"gateway\"" };
        const servers = asked === "gateway" ? [] : asked.split(",").map((s) => s.trim()).filter(Boolean);
        if (servers.length > 4) return { updated: false, reason: "DHCP hands out at most four DNS servers" };
        const fields: Partial<UnifiNetwork> = {
          dhcpd_dns_enabled: servers.length > 0,
          dhcpd_dns_1: servers[0] ?? "",
          dhcpd_dns_2: servers[1] ?? "",
          dhcpd_dns_3: servers[2] ?? "",
          dhcpd_dns_4: servers[3] ?? "",
        };
        const net = await unifi.updateNetwork(String(args.id), fields);
        return { updated: summarizeNetwork(net) };
      },
    },
    {
      name: "unifi_list_devices",
      description: "List the network devices (APs, switches, gateways) the UniFi controller manages.",