package catalogue

// The packet-filter manifest as it was the day the runtime was decided (novox/hq ADR 0175): tools,
// served from a container built on the tool runtime's image, with NET_ADMIN so the container could
// reach the filter. The exact pattern to-be 38 WP4 moves it off, and the one the gate refuses.
const thePacketFilterAsItWas = `{
  "module": "nftables",
  "version": "1",
  "capabilities": ["firewall", "container-runtime"],
  "claims": [{"name": "node-packet-filter", "scope": "node", "serves": ["rules", "reload", "remove"]}],
  "filtering": {"into": "/etc/nftables.conf"},
  "resources": [
    {"id": "mesh-state", "type": "directory", "mode": "0700", "place": "mesh"},
    {"id": "package", "type": "package", "package": "nftables"},
    {"id": "unit", "type": "file", "path": "/etc/systemd/system/mesh-filter.service",
     "content": "[Unit]\nDescription=The mesh's packet filter\n[Service]\nType=oneshot\nExecStart=nft -f /etc/nftables.conf\n", "mode": "0644"},
    {"id": "load", "type": "service", "unit": "mesh-filter.service", "state": "running", "boot": "enabled",
     "restart-on": ["unit"], "reload-on": ["filtering"]},
    {"id": "runtime", "type": "container", "name": "mesh-nftables", "network": "host",
     "capabilities": ["NET_ADMIN"],
     "volumes": ["${dir:mesh-state}/broker:/run/secrets/broker:ro", "/etc/nftables.conf:/etc/nftables.conf:ro"],
     "env": {"MESH_BROKER_FILE": "/run/secrets/broker", "MESH_FILTER_FILE": "/etc/nftables.conf"},
     "artifact": "runtime"}
  ],
  "tools": ["firewall_rules"],
  "own-secrets": {"broker": "${dir:mesh-state}/broker"},
  "build": {
    "on": [
      {"arg": "BUILD_BASE", "module": "mesh-tools", "artifact": "build"},
      {"arg": "RUNTIME_BASE", "module": "mesh-tools", "artifact": "runtime"}
    ],
    "artifacts": [{"name": "runtime", "kind": "image", "from": "Dockerfile"}]
  }
}`