Housecarl 0.1.1's thirteenth release candidate. Since rc.12: quota usage
is saved after every change. make test and make e2e (304 checks) pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Housecarl 0.1.1's twelfth release candidate. Since rc.11: quota usage
as a percentage; Statistics' quotas link to their rules and include
per-address quotas. make test and make e2e (304 checks) pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Housecarl 0.1.1's eleventh release candidate. Since rc.10: a quota keeps
what it used when its rule counts it differently (per address to a total:
the sum; wider groups: added up), or starts again with a warning. make
test, the real-nft quota test and make e2e (304 checks) pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Housecarl 0.1.1's tenth release candidate. Since rc.9: rules read as a
direction ("lan → wan", "any but wan → any"). make test and make e2e
(297 checks) pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Housecarl 0.1.1's ninth release candidate. Since rc.8: a rule's quota is
one line on the Rules page, with its usage, resets and actions in a
dialog. make test passes; the web UI was checked in a browser.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Housecarl 0.1.1's eighth release candidate. Since rc.7: a quota can be
reset for one address, or topped up until its next reset (hc rule
reset-quota --address/--give, Give back in the web UI). make test, the
real-nft quota test and make e2e (297 checks) pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Housecarl 0.1.1's seventh release candidate. Since rc.6: names beside
inside addresses, by reverse lookups (names in housecarl.yaml, POST
/names, hc --no-names); hc stats top devices lists each device once.
make test and make e2e (289 checks) pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Housecarl 0.1.1's sixth release candidate. Since rc.5: the dashboard
lists the rules' quotas. make test passes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Housecarl 0.1.1's fifth release candidate. Since rc.4: a rule added
before, after or first is placed in the same change it is created in
(one history entry, kept in a changeset). make test and make e2e (286
checks) pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Housecarl 0.1.1's fourth release candidate. Since rc.3: the matrix reads
raw rules that are a match and a verdict (the imported neighbour
discovery rule is no longer unknown), and links to a rule open it on the
Rules page, highlighted, with rule IDs shown. make test and make e2e
(286 checks) pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Housecarl 0.1.1's third release candidate. Since rc.2: a clearer zone
matrix (allow, block or partly, what is let through, hits per rule, hc
matrix aligned in colour), and counters that forget objects no longer
there (after an import with --replace). make test and make e2e (285
checks) pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Housecarl 0.1.1's second release candidate. Since rc.1: shadow mode,
Housecarl's ruleset loaded beside the firewall in force, counting,
logging and tracing what it would drop while changing nothing
(docs/shadow.md). make test (with nft 1.1.3), make e2e (282 checks) and
the systemd package test pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Housecarl 0.1.1's first release candidate. Since 0.1.0: an importer
that keeps what rulesets mean in the cases an audit found (chains on one
hook, jumps, repeated matches, forward accepts, raw rules' sets), zone
names given at import, timeout sets as dynamic sets, and multi-port
DNATs. make test (with nft 1.1.3) and make e2e (246 checks) pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Housecarl 0.1.0. Since rc.7: the boot ruleset fails closed (a fallback
keeps anything new from the internet out if it doesn't load), the
flowtable follows devices that appear later or reconnect, /healthz for
monitoring, renaming zones, sets and services with their references,
and an import that keeps a chain's head in order. make test (with nft
1.1.3) and make e2e (242 checks) pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Housecarl 0.1.0's seventh release candidate. Since rc.6: statistics
over time (traffic per zone and device, drops, blocked sources, hits,
connections, quotas, the machine). make test (with nft 1.1.3) and make
e2e (188 checks) pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Housecarl 0.1.0's sixth release candidate. Since rc.5: the zone
matrix, what the rules do to new connections between zones. make test
(with nft 1.1.3) and make e2e (166 checks) pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Housecarl 0.1.0's fifth release candidate. Since rc.4: the connections
the firewall tracks, and closing them; rules that check every packet,
so a block stops connections already open; and a packet tracer that
follows packets through every table's rules. make test (with nft
1.1.3), make e2e (157 checks) and the package test pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Housecarl 0.1.0's fourth release candidate. Since rc.3: undo is staged
like any edit, each chain's built-ins have a window of their own, the
dashboard warns while nftables.service is enabled or an imported table
still applies, and raw rules and dynamic sets refuse fields they used to
ignore silently. make test (with nft 1.1.3), make e2e (140 checks) and
the package test pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Housecarl 0.1.0's third release candidate. Since rc.2: changes made over
the network are confirmed by the client that made them, once it reaches
Housecarl again over a new connection (a change that cuts it off rolls
back by itself), and the rule dialog keeps its less used parts behind
"+" buttons. make test (with nft 1.1.3) and make e2e (136 checks) pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Housecarl 0.1.0's second release candidate. Since rc.1: nftables maps
are imported; changes can be staged in changesets, reviewed with the
ruleset's diff and applied together (the web UI's default, as in Jarl);
bandwidth limits and quotas (per rule or per address, reset on a
schedule, kept across reboots); and generic examples. make test (with
nft 1.1.3) and make e2e (120 checks) pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Housecarl 0.1.0's first release candidate: an nftables firewall manager
with zones, address sets, services and ordered rules, IPv4 and IPv6, port
forwards with hairpin NAT and IPv6 pinholes, source NAT, redirects,
built-ins, probation for network changes, the ruleset at boot, hits and
the drop log, nftables import, a web UI, REST API and CLI. make test
(with nft 1.1.3), make e2e (71 checks) and the package test pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Housecarl will be a firewall manager for nftables, built the way Jarl and
Steward are: housecarld (a daemon with a REST API and web UI), hc (the
CLI) and SQLite.
- The logo: a carved Nordic doorway in Jarl's blue (artwork/logo.svg),
with a small version without the carvings, lighter on dark
backgrounds. scripts/logo.py builds the web UI's copies and
scripts/banner.py the README banner.
- The HOUSECARL wordmark in Jarl's and Steward's angular letters, with
new H, O, U and C (assets/brand.js), and the UI's color tokens.
- housecarld and hc print their version; the Makefile, version package,
AGENTS.md, CHANGELOG and the design sketch (docs/design.md).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
