35 lines
1.8 KiB
Go
35 lines
1.8 KiB
Go
package catalogue
|
|
|
|
// The packet-filter manifest as it was the day the runtime was decided (novox/hq ADR 0175): tools,
|
|
// served from a container built on the tool runtime's image, with NET_ADMIN so the container could
|
|
// reach the filter. The exact pattern to-be 38 WP4 moves it off, and the one the gate refuses.
|
|
const thePacketFilterAsItWas = `{
|
|
"module": "nftables",
|
|
"version": "1",
|
|
"capabilities": ["firewall", "container-runtime"],
|
|
"claims": [{"name": "node-packet-filter", "scope": "node", "serves": ["rules", "reload", "remove"]}],
|
|
"filtering": {"into": "/etc/nftables.conf"},
|
|
"resources": [
|
|
{"id": "mesh-state", "type": "directory", "mode": "0700", "place": "mesh"},
|
|
{"id": "package", "type": "package", "package": "nftables"},
|
|
{"id": "unit", "type": "file", "path": "/etc/systemd/system/mesh-filter.service",
|
|
"content": "[Unit]\nDescription=The mesh's packet filter\n[Service]\nType=oneshot\nExecStart=nft -f /etc/nftables.conf\n", "mode": "0644"},
|
|
{"id": "load", "type": "service", "unit": "mesh-filter.service", "state": "running", "boot": "enabled",
|
|
"restart-on": ["unit"], "reload-on": ["filtering"]},
|
|
{"id": "runtime", "type": "container", "name": "mesh-nftables", "network": "host",
|
|
"capabilities": ["NET_ADMIN"],
|
|
"volumes": ["${dir:mesh-state}/broker:/run/secrets/broker:ro", "/etc/nftables.conf:/etc/nftables.conf:ro"],
|
|
"env": {"MESH_BROKER_FILE": "/run/secrets/broker", "MESH_FILTER_FILE": "/etc/nftables.conf"},
|
|
"artifact": "runtime"}
|
|
],
|
|
"tools": ["firewall_rules"],
|
|
"own-secrets": {"broker": "${dir:mesh-state}/broker"},
|
|
"build": {
|
|
"on": [
|
|
{"arg": "BUILD_BASE", "module": "mesh-tools", "artifact": "build"},
|
|
{"arg": "RUNTIME_BASE", "module": "mesh-tools", "artifact": "runtime"}
|
|
],
|
|
"artifacts": [{"name": "runtime", "kind": "image", "from": "Dockerfile"}]
|
|
}
|
|
}`
|