8 Commits

Include renames

Author	SHA1	Message	Date
jochen	6e6cd5e26d	Admit a port from the machine's own local network, and never a public subnet (issue 154, ADR 0340) ... A local service could only be declared public, which says the internet. local-network is a source and a reach: the private network and the private networks the machine reported on a link facing outside, judged here, shown by plan and node, and said in the rule set when there are none.	2026-10-13 11:20:22 +02:00
jschoubben	fad8b30e43	Say that the guard names the runtime's bridges where the filter names their addresses (hq ADR 0103)	2026-09-22 19:51:10 +02:00
jschoubben	cc47330884	Reload the guard on its table rather than restart it, so a change leaves no port unguarded (hq ADR 0103)	2026-09-22 18:27:27 +02:00
jschoubben	ade6b2bfb6	Declare nftables before the guard's table, so a node joining adopted without nft can load it (hq ADR 0103)	2026-09-22 17:59:32 +02:00
jschoubben	a2dfaaf4d1	Guard only packets addressed to this machine, and order the guard's unit before the network and against shutdown (hq ADR 0103)	2026-09-22 17:59:09 +02:00
jschoubben	a82bfb41f2	Leave an IPv6 loopback mapping out of what a container publishes, reading ports from the end (hq ADR 0100)	2026-09-22 17:58:50 +02:00
jschoubben	c93128d82f	Hold the catalogue's store, broker and filter manifests to what adoption needs of them (hq ADR 0100)	2026-09-22 17:33:09 +02:00
jschoubben	c3b1617693	Declare openings and a refusal-only guard on an adopted node in place of the filter (hq ADR 0100)	2026-09-22 17:21:44 +02:00