abrown38andClaude Opus 5.5
54beb0bba3
Housecarl will be a firewall manager for nftables, built the way Jarl and Steward are: housecarld (a daemon with a REST API and web UI), hc (the CLI) and SQLite. - The logo: a carved Nordic doorway in Jarl's blue (artwork/logo.svg), with a small version without the carvings, lighter on dark backgrounds. scripts/logo.py builds the web UI's copies and scripts/banner.py the README banner. - The HOUSECARL wordmark in Jarl's and Steward's angular letters, with new H, O, U and C (assets/brand.js), and the UI's color tokens. - housecarld and hc print their version; the Makefile, version package, AGENTS.md, CHANGELOG and the design sketch (docs/design.md). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Housecarl
Every Jarl has a housecarl at his side; this one keeps the door.
Housecarl will be a firewall for Linux that you manage through a web UI, a
REST API and a command line client (hc), all three backed by the same
API. It is the third of a set with Jarl,
the BIND manager, and Steward, the
DHCP server, and works the same way: every change is checked as a whole
before it is used, is recorded in a history where it can be undone, and is
audited.
In Skyrim, a housecarl is the Jarl's sworn bodyguard: it stands at the door and decides who comes in. Housecarl does that for your network. It keeps the machine's nftables ruleset, built from its own database, in one table of its own.
What it will do
- Zones for your interfaces and VLANs (
lan,iot,guest,wan), with a default policy between each pair, and rules between them. - Address sets that rules refer to, whose entries can expire by themselves; another program can be allowed to change just one set. That is how Steward's captive portal will let a guest in.
- NAT: masquerading and port forwards.
- Changes you can trust: validated as a whole, checked by nftables before they are applied, applied in one transaction, and undoable. A change that could lock you out is rolled back unless you confirm it.
See docs/design.md for the plan and the open questions.
Status
Housecarl is at its start: it has its name, its logo and the skeleton of
the daemon (housecarld) and CLI (hc). There is nothing to run yet.
Licence
MIT, see LICENSE.