hc rule add --before/--after/--first created the rule at the end of its
chain and then moved it: two history entries, two probations, the rule
briefly in force in the wrong place, and in a changeset the place was
lost. POST /rules (and the other ordered kinds) now takes ?before=ID,
?after=ID or ?first=1, kept with the operation when staged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Undo is staged like any edit: in review mode the web UI's Undo, and hc
history undo with -C or HOUSECARL_CHANGESET, add a revert operation
that checks, when replayed, that nothing it touches changed since;
applied, History links the entries. Imports and takeovers still can't
be staged.
- The rules page sums up a chain's built-ins in one line; a window lists
them with what they do and their hits, and switches them.
- Warnings about the machine (dashboard, hc status): nftables.service
enabled (it loads /etc/nftables.conf at boot and flushes every table
when stopped), and the imported table still in force beside
Housecarl's. The docs say to disable nftables.service but not stop it.
- A raw rule with other fields set is refused (raw_conflict) instead of
silently ignoring them; the rule dialog's nftables section hides what
it replaces, and the importer's raw rules carry only their text.
- A dynamic set with configured entries is refused
(set_dynamic_entries): they were silently ignored. The set dialog
shows entries or the entry timeout, as fits.
- The rule dialog's chain choices are just the chains' names.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Changesets, as in Jarl: configuration changes are operations that can be
staged in a changeset, checked as they are added (validation and nft -c),
reviewed with the diff of the ruleset, and applied together as one
history entry, then on probation like any change made over the network.
The web UI collects edits for review by default (pending rows, a bar with
Review and Apply now, a Changes page, a switch for live edits); hc stages
with -C ID or HOUSECARL_CHANGESET (checked like JARL_CHANGESET) and has
hc changeset create/list/show/diff/apply/discard/remove. Undo, import and
takeover refuse a changeset. --dry-run shows the ruleset's diff.
Bandwidth and quotas: rate limits in bytes, per source or destination;
quotas per rule or per address that reset daily, weekly, monthly on a
day, or by hand, with their usage carried across reloads, saved for
reboots, shown by hc quotas and on the rules page, and reset with hc rule
reset-quota. Rules that count traffic are checked before established
connections are accepted (so they see every packet) and can't accept.
Per-address limits group IPv6 by /64 by default (--group-v4/-v6).
Per-source rate meters use update. The importer turns meters, byte rates
and quotas into these fields.
The examples in the web UI, hc's help and the docs use documentation
addresses and generic names instead of the maintainer's network.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
abrown38andClaude Opus 5.5