jochen
1fd2914ae1
With a gate on the first machine and a rollback after it, a module's build rolls out by default. The ones kept back say why: the network path a rollback could not cross, the providers every consumer on a machine drops with, and the stores holding the photos. A merge's deleted files are announced, so a module whose manifest went is forgotten rather than asked to build (the public-acme plan failure).
87 lines
2.2 KiB
JSON
87 lines
2.2 KiB
JSON
{
|
|
"module": "nftables",
|
|
"version": "1",
|
|
"upgrade": {
|
|
"policy": "record",
|
|
"why": "the machine's packet filter: a build that breaks it can cut the machine off from the bus, and then neither the gate's rollback nor a push reaches it (hq ADR 0236)"
|
|
},
|
|
"capabilities": [
|
|
"firewall"
|
|
],
|
|
"claims": [
|
|
{
|
|
"name": "node-packet-filter",
|
|
"scope": "node",
|
|
"serves": [
|
|
"rules",
|
|
"reload",
|
|
"remove"
|
|
]
|
|
}
|
|
],
|
|
"filtering": {
|
|
"into": "/etc/nftables.conf"
|
|
},
|
|
"resources": [
|
|
{
|
|
"id": "package",
|
|
"type": "package",
|
|
"package": "nftables"
|
|
},
|
|
{
|
|
"id": "legacy-tools",
|
|
"type": "package",
|
|
"package": "iptables"
|
|
},
|
|
{
|
|
"id": "unit",
|
|
"type": "file",
|
|
"path": "/etc/systemd/system/mesh-filter.service",
|
|
"content": "[Unit]\nDescription=The mesh's packet filter, derived from what is assigned to this node\nWants=network-pre.target\nBefore=network-pre.target\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=nft -f /etc/nftables.conf\nExecReload=nft -f /etc/nftables.conf\nExecStop=nft delete table inet mesh\n\n[Install]\nWantedBy=multi-user.target\n",
|
|
"mode": "0644"
|
|
},
|
|
{
|
|
"id": "stock-unit-stop",
|
|
"type": "file",
|
|
"path": "/etc/systemd/system/nftables.service.d/mesh.conf",
|
|
"content": "# The mesh: stopping the stock unit deletes only the mesh's table, never the whole ruleset\n# (novox/hq ADR 0100) — a flush would take the container runtime's rules and any firewall with it.\n[Service]\nExecStop=\nExecStop=nft delete table inet mesh\n",
|
|
"mode": "0644"
|
|
},
|
|
{
|
|
"id": "load",
|
|
"type": "service",
|
|
"unit": "mesh-filter.service",
|
|
"state": "running",
|
|
"boot": "enabled",
|
|
"restart-on": [
|
|
"unit",
|
|
"stock-unit-stop"
|
|
],
|
|
"reload-on": [
|
|
"filtering"
|
|
]
|
|
},
|
|
{
|
|
"id": "front-end",
|
|
"type": "package",
|
|
"package": "ufw",
|
|
"absent": true
|
|
}
|
|
],
|
|
"tools": [
|
|
"firewall_rules"
|
|
],
|
|
"build": {
|
|
"artifacts": [
|
|
{
|
|
"name": "tools",
|
|
"kind": "bundle",
|
|
"language": "typescript",
|
|
"entrypoints": [
|
|
"tools/index.js"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|