Housecarl 0.1.0's fifth release candidate. Since rc.4: the connections
the firewall tracks, and closing them; rules that check every packet,
so a block stops connections already open; and a packet tracer that
follows packets through every table's rules. make test (with nft
1.1.3), make e2e (157 checks) and the package test pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Connections: the kernel's tracked connections, read and closed over
ctnetlink (internal/conntrack, raw netlink like the drop log), with
their NAT and TCP state; closing one makes the rules check its next
packet again (GET /connections, POST /connections/close; hc
connections; Traffic → Connections).
- Rules can check every packet (every_packet, --every-packet): before
established connections are accepted, so a drop or reject also stops
connections already open. They can't accept.
- A packet tracer (internal/trace): a table of its own, inet
housecarl-trace, marks the packets a filter picks, `nft monitor trace`
reports every rule and policy they meet in every table, and the tracer
names what accepted or dropped them, Housecarl's rules by name (POST,
GET, DELETE /trace; hc trace; Traffic → Trace). One trace at a time,
at most 200 packets and 20 a second; the table goes when it ends.
e2e: 157 checks, among them an upload a normal block doesn't stop and an
every-packet one does, and a trace naming the blocking rule.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Housecarl 0.1.0's fourth release candidate. Since rc.3: undo is staged
like any edit, each chain's built-ins have a window of their own, the
dashboard warns while nftables.service is enabled or an imported table
still applies, and raw rules and dynamic sets refuse fields they used to
ignore silently. make test (with nft 1.1.3), make e2e (140 checks) and
the package test pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Housecarl 0.1.0's third release candidate. Since rc.2: changes made over
the network are confirmed by the client that made them, once it reaches
Housecarl again over a new connection (a change that cuts it off rolls
back by itself), and the rule dialog keeps its less used parts behind
"+" buttons. make test (with nft 1.1.3) and make e2e (136 checks) pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Housecarl 0.1.0's second release candidate. Since rc.1: nftables maps
are imported; changes can be staged in changesets, reviewed with the
ruleset's diff and applied together (the web UI's default, as in Jarl);
bandwidth limits and quotas (per rule or per address, reset on a
schedule, kept across reboots); and generic examples. make test (with
nft 1.1.3) and make e2e (120 checks) pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Changesets, as in Jarl: configuration changes are operations that can be
staged in a changeset, checked as they are added (validation and nft -c),
reviewed with the diff of the ruleset, and applied together as one
history entry, then on probation like any change made over the network.
The web UI collects edits for review by default (pending rows, a bar with
Review and Apply now, a Changes page, a switch for live edits); hc stages
with -C ID or HOUSECARL_CHANGESET (checked like JARL_CHANGESET) and has
hc changeset create/list/show/diff/apply/discard/remove. Undo, import and
takeover refuse a changeset. --dry-run shows the ruleset's diff.
Bandwidth and quotas: rate limits in bytes, per source or destination;
quotas per rule or per address that reset daily, weekly, monthly on a
day, or by hand, with their usage carried across reloads, saved for
reboots, shown by hc quotas and on the rules page, and reset with hc rule
reset-quota. Rules that count traffic are checked before established
connections are accepted (so they see every packet) and can't accept.
Per-address limits group IPv6 by /64 by default (--group-v4/-v6).
Per-source rate meters use update. The importer turns meters, byte rates
and quotas into these fields.
The examples in the web UI, hc's help and the docs use documentation
addresses and generic names instead of the maintainer's network.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Housecarl 0.1.0's first release candidate: an nftables firewall manager
with zones, address sets, services and ordered rules, IPv4 and IPv6, port
forwards with hairpin NAT and IPv6 pinholes, source NAT, redirects,
built-ins, probation for network changes, the ruleset at boot, hits and
the drop log, nftables import, a web UI, REST API and CLI. make test
(with nft 1.1.3), make e2e (71 checks) and the package test pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Zones, address sets (IPv4 and IPv6 mixed, dynamic sets with timeouts) and
services, ordered rules in the early, input, forward and output chains,
port forwards with hairpin NAT and IPv6 pinholes, source NAT, redirects,
and switchable built-ins (loopback, conntrack, ICMPv6, antispoofing, MSS
clamping, DHCPv6 client, flowtable). Every change is validated, checked
with nft -c and applied in one transaction to Housecarl's own table,
inet housecarl; changes made over the network roll back unless
confirmed, and the confirmed ruleset is loaded at boot by
housecarl-ruleset.service. An empty configuration applies nothing.
Also: hit counters and the drop log (nflog), 'hc import' of an existing
nftables ruleset and 'hc takeover', the hc CLI, the REST API and the web
UI, users, scoped tokens (sets:write:NAME), the audit log, the web UI's
certificate through Jarl, Debian packages, docs, unit tests with real
nft 1.1.3, and an e2e test with real traffic (71 checks).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Housecarl will be a firewall manager for nftables, built the way Jarl and
Steward are: housecarld (a daemon with a REST API and web UI), hc (the
CLI) and SQLite.
- The logo: a carved Nordic doorway in Jarl's blue (artwork/logo.svg),
with a small version without the carvings, lighter on dark
backgrounds. scripts/logo.py builds the web UI's copies and
scripts/banner.py the README banner.
- The HOUSECARL wordmark in Jarl's and Steward's angular letters, with
new H, O, U and C (assets/brand.js), and the UI's color tokens.
- housecarld and hc print their version; the Makefile, version package,
AGENTS.md, CHANGELOG and the design sketch (docs/design.md).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
abrown38andClaude Opus 5.5