Add changesets, bandwidth limits and quotas; generic examples

Changesets, as in Jarl: configuration changes are operations that can be
staged in a changeset, checked as they are added (validation and nft -c),
reviewed with the diff of the ruleset, and applied together as one
history entry, then on probation like any change made over the network.
The web UI collects edits for review by default (pending rows, a bar with
Review and Apply now, a Changes page, a switch for live edits); hc stages
with -C ID or HOUSECARL_CHANGESET (checked like JARL_CHANGESET) and has
hc changeset create/list/show/diff/apply/discard/remove. Undo, import and
takeover refuse a changeset. --dry-run shows the ruleset's diff.

Bandwidth and quotas: rate limits in bytes, per source or destination;
quotas per rule or per address that reset daily, weekly, monthly on a
day, or by hand, with their usage carried across reloads, saved for
reboots, shown by hc quotas and on the rules page, and reset with hc rule
reset-quota. Rules that count traffic are checked before established
connections are accepted (so they see every packet) and can't accept.
Per-address limits group IPv6 by /64 by default (--group-v4/-v6).
Per-source rate meters use update. The importer turns meters, byte rates
and quotas into these fields.

The examples in the web UI, hc's help and the docs use documentation
addresses and generic names instead of the maintainer's network.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/hc/main.go

@@ -132,6 +132,9 @@ func newClient() (*client.Client, error) {
 		return nil, err
 	}
 	c.DryRun = flagDryRun
+	if err := setupChangeset(c); err != nil {
+		return nil, err
+	}
 	return c, nil
 }
 
@@ -143,7 +146,10 @@ func rootCmd() *cobra.Command {
 
 Every change is checked as a whole, then by nftables, before it is put in
 force, and is recorded in the history, where 'hc history undo ID' takes it
-back. --dry-run shows what a change would do.
+back. --dry-run shows what a change would do, with the ruleset's diff.
+Changes are made at once; to review several and apply them together,
+stage them in a changeset ('hc changeset --help', -C ID or
+HOUSECARL_CHANGESET).
 
 A change made over the network is on probation: confirm it with 'hc
 confirm' (within 2 minutes by default) or it is rolled back by itself, so a
@@ -169,6 +175,7 @@ Exit codes: 0 ok, 1 error, 3 not authenticated or not allowed, 4 not found,
 	pf.BoolVar(&flagInsecure, "insecure", false, "don't verify the server's TLS certificate")
 	pf.StringVar(&flagCACert, "ca-cert", "", "PEM file with a CA to trust for the server's certificate")
 	pf.BoolVarP(&flagQuiet, "quiet", "q", false, "print only errors (and IDs of new objects)")
+	pf.Int64VarP(&flagChangeset, "changeset", "C", 0, "stage configuration changes in this changeset instead of applying them (env HOUSECARL_CHANGESET)")
 	root.AddGroup(&cobra.Group{ID: "fw", Title: "Firewall:"}, &cobra.Group{ID: "changes", Title: "Changes:"}, &cobra.Group{ID: "admin", Title: "Administration:"})
 	add := func(group string, cmds ...*cobra.Command) {
 		for _, c := range cmds {
@@ -177,8 +184,8 @@ Exit codes: 0 ok, 1 error, 3 not authenticated or not allowed, 4 not found,
 		}
 	}
 	add("fw", statusCmd(), zoneCmd(), setCmd(), serviceCmd(), ruleCmd(), forwardCmd(), snatCmd(), redirectCmd(), settingsCmd(),
-		rulesetCmd(), countersCmd(), logCmd(), interfaceCmd())
-	add("changes", confirmCmd(), rollbackCmd(), historyCmd(), importCmd(), takeoverCmd())
+		rulesetCmd(), countersCmd(), quotasCmd(), logCmd(), interfaceCmd())
+	add("changes", changesetCmd(), confirmCmd(), rollbackCmd(), historyCmd(), importCmd(), takeoverCmd())
 	add("admin", whoamiCmd(), userCmd(), tokenCmd(), passwordCmd(), certCmd(), auditCmd(), configCmd())
 	return root
 }
@@ -237,8 +244,6 @@ func outputIDs(v any) error {
 		if m, ok := it.(map[string]any); ok {
 			if id, ok := m["id"]; ok {
 				fmt.Println(id)
-			} else if ip, ok := m["ip"]; ok {
-				fmt.Println(ip)
 			}
 		}
 	}
@@ -310,6 +315,9 @@ func report(resp *api.MutationResponse) error {
 		if resp.DryRun {
 			return "would " + c.Action()
 		}
+		if resp.Staged {
+			return "staged: " + c.Action()
+		}
 		return c.Action() + "d"
 	}
 	if !flagQuiet || resp.DryRun {
@@ -322,7 +330,18 @@ func report(resp *api.MutationResponse) error {
 		}
 	}
 	switch {
+	case resp.Staged && resp.Changeset != nil:
+		if !flagQuiet {
+			cs := resp.Changeset
+			fmt.Fprintf(w, "staged in changeset %d as operation %d (%s now); review with 'hc changeset diff %d', apply with 'hc changeset apply %d'\n",
+				cs.ID, cs.Ops[len(cs.Ops)-1].Seq, plural(len(cs.Ops), "operation"), cs.ID, cs.ID)
+		}
 	case resp.DryRun:
+		if resp.Diff != "" && !flagQuiet {
+			fmt.Fprintln(w)
+			printDiff(w, resp.Diff)
+			fmt.Fprintln(w)
+		}
 		fmt.Fprintln(w, "dry run: nothing was changed")
 	case resp.Applied && resp.ConfirmBy != nil:
 		fmt.Fprintf(w, "applied on probation (history %d): confirm with 'hc confirm' within %s, or it is rolled back\n",
@@ -332,7 +351,7 @@ func report(resp *api.MutationResponse) error {
 	case !resp.Applied && len(resp.Changes) == 0 && !flagQuiet:
 		fmt.Fprintln(w, "nothing to change")
 	}
-	if flagQuiet && len(resp.Object) > 0 && resp.Applied {
+	if flagQuiet && len(resp.Object) > 0 && (resp.Applied || resp.Staged) {
 		outputIDs(resp.Object)
 	}
 	printProblems(os.Stderr, resp.Warnings)