abrown38andClaude Opus 5.5
54beb0bba3
Housecarl will be a firewall manager for nftables, built the way Jarl and Steward are: housecarld (a daemon with a REST API and web UI), hc (the CLI) and SQLite. - The logo: a carved Nordic doorway in Jarl's blue (artwork/logo.svg), with a small version without the carvings, lighter on dark backgrounds. scripts/logo.py builds the web UI's copies and scripts/banner.py the README banner. - The HOUSECARL wordmark in Jarl's and Steward's angular letters, with new H, O, U and C (assets/brand.js), and the UI's color tokens. - housecarld and hc print their version; the Makefile, version package, AGENTS.md, CHANGELOG and the design sketch (docs/design.md). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
42 lines
1.8 KiB
Markdown
42 lines
1.8 KiB
Markdown
<p align="center"><img src="artwork/banner.svg" width="340" alt="Housecarl: a carved Nordic doorway, above the HOUSECARL wordmark"></p>
|
|
|
|
# Housecarl
|
|
|
|
*Every Jarl has a housecarl at his side; this one keeps the door.*
|
|
|
|
Housecarl will be a firewall for Linux that you manage through a web UI, a
|
|
REST API and a command line client (`hc`), all three backed by the same
|
|
API. It is the third of a set with [Jarl](https://gitea.adbraun.lol/adam/jarl),
|
|
the BIND manager, and [Steward](https://gitea.adbraun.lol/adam/steward), the
|
|
DHCP server, and works the same way: every change is checked as a whole
|
|
before it is used, is recorded in a history where it can be undone, and is
|
|
audited.
|
|
|
|
In Skyrim, a housecarl is the Jarl's sworn bodyguard: it stands at the
|
|
door and decides who comes in. Housecarl does that for your network. It
|
|
keeps the machine's nftables ruleset, built from its own database, in one
|
|
table of its own.
|
|
|
|
## What it will do
|
|
|
|
* **Zones** for your interfaces and VLANs (`lan`, `iot`, `guest`, `wan`),
|
|
with a default policy between each pair, and rules between them.
|
|
* **Address sets** that rules refer to, whose entries can expire by
|
|
themselves; another program can be allowed to change just one set. That
|
|
is how Steward's captive portal will let a guest in.
|
|
* **NAT**: masquerading and port forwards.
|
|
* **Changes you can trust**: validated as a whole, checked by nftables
|
|
before they are applied, applied in one transaction, and undoable. A
|
|
change that could lock you out is rolled back unless you confirm it.
|
|
|
|
See [docs/design.md](docs/design.md) for the plan and the open questions.
|
|
|
|
## Status
|
|
|
|
Housecarl is at its start: it has its name, its logo and the skeleton of
|
|
the daemon (`housecarld`) and CLI (`hc`). There is nothing to run yet.
|
|
|
|
## Licence
|
|
|
|
MIT, see [LICENSE](LICENSE).
|