jschoubben
df74b712c0
Converted mechanically from mesh-sdk's compiled list at 5a38a12 by a program kept out of the repository; the three new registry seats follow npm-package-registry, operator-channel the mesh's own seats. Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
63 lines
1.8 KiB
JSON
63 lines
1.8 KiB
JSON
{
|
|
"format": 1,
|
|
"seat": "node-packet-filter",
|
|
"scope": "node",
|
|
"grain": "seat-list",
|
|
"decision": "novox/hq ADR 0121",
|
|
"verbs": [
|
|
{
|
|
"name": "rules",
|
|
"description": "The packet filter as this machine enforces it now: the nftables ruleset and, where the tool exists, the legacy filter's listings. Narrowed to one table or chain when asked.",
|
|
"replaces": [
|
|
"nft list ruleset",
|
|
"iptables -L",
|
|
"iptables-save"
|
|
],
|
|
"input": {
|
|
"properties": {
|
|
"chain": {
|
|
"description": "one chain of that table (optional)",
|
|
"type": "string"
|
|
},
|
|
"table": {
|
|
"description": "one nftables table, as `family name` (optional)",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"type": "object"
|
|
}
|
|
},
|
|
{
|
|
"name": "reload",
|
|
"description": "Load the mesh's own filter again from the file the mesh writes, and answer with the mesh's table as loaded.",
|
|
"replaces": [
|
|
"nft -f"
|
|
],
|
|
"input": {
|
|
"properties": {},
|
|
"type": "object"
|
|
}
|
|
},
|
|
{
|
|
"name": "remove",
|
|
"description": "Remove one rule set the mesh did not write, named exactly as the host reports it (novox/hq ADR 0168) — `chain X (iptables-legacy)` or `table ip6 filter, chain DOCKER-USER`. Refuses the mesh's tables, the runtime's own chains, a built-in chain and an active found firewall's chains. An operator's act, by name, never a flush.",
|
|
"replaces": [
|
|
"nft delete",
|
|
"iptables -X"
|
|
],
|
|
"input": {
|
|
"properties": {
|
|
"where": {
|
|
"description": "the rule set, as `node show` lists it",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"where"
|
|
],
|
|
"type": "object"
|
|
}
|
|
}
|
|
]
|
|
}
|