abrown38andClaude Opus 5.5
9d766b9823
The boot unit fails closed: if ruleset.nft doesn't load, it loads ruleset-fallback.nft (render.Fallback), saved beside it from the same configuration: nothing new in from external zones, established, the ICMPv6 IPv6 needs and DHCPv6 replies let in, the inside left alone and masqueraded, and the unit marked failed with a critical message. housecarld replaces it when it applies; status, the dashboard and /healthz say while it is in force. no_external_zone now also says the fallback closes everything without an external zone. The boot ruleset has no flowtable: nftables on Debian 13's kernel refuses one naming a device that doesn't exist yet (ppp0 before PPPoE), and with it the whole file. internal/linkwatch listens to rtnetlink link messages; housecarld applies again when a flowtable device appears or comes back as a new interface (by ifindex), under the engine's lock. docs/flowtable.md: what it does, when to use it and when not, how. GET /healthz reports firewall (applied, unconfigured, fallback, missing), changes on probation and the machine's warnings, with 503 unless in force, read at most every five seconds. Renaming a zone, set or service changes what names it in the same change (one history entry, one undo); dynamic sets keep their names. The importer keeps a chain's head in order: once a would-be built-in stays a rule, the ones after it do too, so the maintainer's ICMPv6 accepts stay behind the invalid drop as written. hc settings set --flowtable none empties the list. make test (nft 1.1.3) and make e2e (242 checks, with VLAN sub-interfaces, the fallback and the flowtable) pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
26 lines
1.2 KiB
Desktop File
26 lines
1.2 KiB
Desktop File
# Housecarl: loads the last confirmed ruleset at boot, before the network
|
|
# comes up and whether or not housecarld starts. If it fails to load, the
|
|
# fallback housecarld saved beside it is loaded instead: nothing new gets
|
|
# in from external zones (docs/operations.md), and the unit is marked
|
|
# failed, until housecarld starts and puts the real ruleset back.
|
|
# Installed as /etc/systemd/system/housecarl-ruleset.service.
|
|
[Unit]
|
|
Description=Housecarl firewall ruleset
|
|
Documentation=file:///usr/local/share/doc/housecarl/README.md
|
|
DefaultDependencies=no
|
|
Before=network-pre.target shutdown.target
|
|
Wants=network-pre.target
|
|
# Debian's nftables.service flushes the whole ruleset: Housecarl's loads after it.
|
|
After=nftables.service local-fs.target
|
|
Conflicts=shutdown.target
|
|
ConditionPathExists=/var/lib/housecarl/ruleset.nft
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
RemainAfterExit=yes
|
|
# "<2>": logged as critical.
|
|
ExecStart=/bin/sh -c '/usr/sbin/nft -f /var/lib/housecarl/ruleset.nft && exit 0; echo "<2>the saved ruleset failed to load: loading the fallback (nothing new gets in from external zones) until housecarld puts the real one back" >&2; /usr/sbin/nft -f /var/lib/housecarl/ruleset-fallback.nft; exit 1'
|
|
|
|
[Install]
|
|
WantedBy=sysinit.target
|