# Housecarl *Every Jarl has a housecarl at his side; this one keeps the door.* Housecarl will be a firewall for Linux that you manage through a web UI, a REST API and a command line client (`hc`), all three backed by the same API. It is the third of a set with [Jarl](https://gitea.adbraun.lol/adam/jarl), the BIND manager, and [Steward](https://gitea.adbraun.lol/adam/steward), the DHCP server, and works the same way: every change is checked as a whole before it is used, is recorded in a history where it can be undone, and is audited. In Skyrim, a housecarl is the Jarl's sworn bodyguard: it stands at the door and decides who comes in. Housecarl does that for your network. It keeps the machine's nftables ruleset, built from its own database, in one table of its own. ## What it will do * **Zones** for your interfaces and VLANs (`lan`, `iot`, `guest`, `wan`), with a default policy between each pair, and rules between them. * **Address sets** that rules refer to, whose entries can expire by themselves; another program can be allowed to change just one set. That is how Steward's captive portal will let a guest in. * **NAT**: masquerading and port forwards. * **Changes you can trust**: validated as a whole, checked by nftables before they are applied, applied in one transaction, and undoable. A change that could lock you out is rolled back unless you confirm it. See [docs/design.md](docs/design.md) for the plan and the open questions. ## Status Housecarl is at its start: it has its name, its logo and the skeleton of the daemon (`housecarld`) and CLI (`hc`). There is nothing to run yet. ## Licence MIT, see [LICENSE](LICENSE).