1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
|
if node.os != "alpine":
raise BundleError(f"{node.name}: OS {node.os} is not supported.")
from os.path import join
actions = {
"restart_container_bundle": {
"command": "s6-rc -bt 30000 stop containers && s6-rc -bt 30000 start containers",
"triggered": True,
}
}
# TODO: fix on shimakaze, missing rules for photos./tv.
svc_openrc = {
"nftables": {
"runlevel": "boot",
"enabled": True,
"running": True,
"needs": {
"pkg_apk:nftables",
},
"triggers": {
# NOTE: required because restart nftables drops all rules and
# podman will install rules to enable container networking
"action:restart_container_bundle",
},
},
}
files = {
# overwrite content_type to allowing templating ssh port
"/etc/nftables.d/22-ssh.nft": { "content_type": "mako" }
}
repo.libs.gen.add_files_recursive(
files,
join(repo.path, "bundles", "firewall", "files"),
{
"triggers": {
"svc_openrc:nftables:restart",
},
}
)
|
