Replace the nftables role with host_firewall, one atomic inet host input table with zones, geo sets and lockout rollback

2026-10-07 07:29:29 +00:00
parent 27e9d4a1ab
commit cfe87002c5
19 changed files with 417 additions and 227 deletions
@@ -0,0 +1,8 @@
+[Unit]
+Description=Refresh the geo sets of the host firewall
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/nft-host-geo
@@ -0,0 +1,10 @@
+[Unit]
+Description=Daily refresh of the host firewall geo sets
+
+[Timer]
+OnCalendar=daily
+RandomizedDelaySec=6h
+Persistent=true
+
+[Install]
+WantedBy=timers.target
@@ -0,0 +1,9 @@
+#!/bin/sh
+# Started by a transient timer before a rule set load; Ansible stops the timer
+# once the new rule set is confirmed.
+cd /etc/nftables.d || exit 1
+mv -f host.nft host.nft.rolled-back
+if [ -s host.nft.good ]; then
+	cp host.nft.good host.nft && nft -f host.nft && exit 0
+fi
+nft delete table inet host
@@ -0,0 +1,22 @@
+[Unit]
+Description=Host input firewall (nftables table inet host)
+# Same early-boot placement as nftables.service. Its "flush ruleset" on start,
+# reload and stop would wipe this table, so load after it and follow all three.
+DefaultDependencies=no
+Wants=network-pre.target
+Before=network-pre.target shutdown.target
+After=nftables.service
+PartOf=nftables.service
+ReloadPropagatedFrom=nftables.service
+Conflicts=shutdown.target
+ConditionPathExists=/etc/nftables.d/host.nft
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/sbin/nft -f /etc/nftables.d/host.nft
+ExecReload=/usr/sbin/nft -f /etc/nftables.d/host.nft
+ExecStop=-/usr/sbin/nft delete table inet host
+
+[Install]
+WantedBy=sysinit.target