From 38be6c13f76e893cf47636257071b440dec0c5b2 Mon Sep 17 00:00:00 2001 From: Robert Günzler Date: Sun, 7 Sep 2025 17:32:13 +0200 Subject: initial commit MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Robert Günzler --- bundles/firewall/items.py | 43 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) create mode 100644 bundles/firewall/items.py (limited to 'bundles/firewall/items.py') diff --git a/bundles/firewall/items.py b/bundles/firewall/items.py new file mode 100644 index 0000000..1949d13 --- /dev/null +++ b/bundles/firewall/items.py @@ -0,0 +1,43 @@ +if node.os != "alpine": + raise BundleError(f"{node.name}: OS {node.os} is not supported.") + +from os.path import join + +actions = { + "restart_container_bundle": { + "command": "s6-rc -bt 30000 stop containers && s6-rc -bt 30000 start containers", + "triggered": True, + } +} + +# TODO: fix on shimakaze, missing rules for photos./tv. +svc_openrc = { + "nftables": { + "runlevel": "boot", + "enabled": True, + "running": True, + "needs": { + "pkg_apk:nftables", + }, + "triggers": { + # NOTE: required because restart nftables drops all rules and + # podman will install rules to enable container networking + "action:restart_container_bundle", + }, + }, +} + +files = { + # overwrite content_type to allowing templating ssh port + "/etc/nftables.d/22-ssh.nft": { "content_type": "mako" } +} + +repo.libs.gen.add_files_recursive( + files, + join(repo.path, "bundles", "firewall", "files"), + { + "triggers": { + "svc_openrc:nftables:restart", + }, + } +) -- cgit 1.4.1