Documentation
¶
Overview ¶
Package firewall is a built-in app modelling a host-wide inbound/outbound firewall. Scaffold only: rules are persisted and validated, Apply is a no-op (enforcement via nftables/iptables is not wired yet).
Index ¶
Constants ¶
const ( PolicyAllow = "allow" PolicyDeny = "deny" DirInbound = "inbound" DirOutbound = "outbound" )
Variables ¶
This section is empty.
Functions ¶
func Apply ¶
Apply enforces the config on the host firewall, or removes FlatRun's rules when the firewall is disabled. It reports whether enforcement actually happened: when nft is unavailable (a non-Linux host, or nft not installed) the config is still saved but not enforced, which is not an error.
Before a new ruleset is loaded the current one is snapshotted, and if the load fails the snapshot is restored, so a rejected ruleset never leaves the host in a half-applied state. The generated ruleset always keeps loopback, established/related, and the active SSH port open, so a default-deny inbound policy cannot drop the operator's session.
Types ¶
type Config ¶
type Config struct {
Enabled bool `yaml:"enabled" json:"enabled"`
// DefaultInbound / DefaultOutbound are the stance applied to traffic not matched by a
// rule: "allow" (default) or "deny".
DefaultInbound string `yaml:"default_inbound,omitempty" json:"default_inbound,omitempty"`
DefaultOutbound string `yaml:"default_outbound,omitempty" json:"default_outbound,omitempty"`
Rules []Rule `yaml:"rules,omitempty" json:"rules,omitempty"`
}
Config is the host firewall policy, stored globally in .flatrun/firewall.yml.
type Plugin ¶
type Plugin struct {
// contains filtered or unexported fields
}
Plugin is the built-in Firewall app. It implements plugins.Plugin so it registers in the plugin registry and lists as an installed app.
func (*Plugin) EnforceCurrent ¶
EnforceCurrent applies the stored config to the host firewall. The server calls it at startup so a saved policy takes effect again after a restart.
func (*Plugin) GetCapabilities ¶
func (p *Plugin) GetCapabilities() []plugins.Capability
func (*Plugin) GetWidgetData ¶
func (*Plugin) Info ¶
func (p *Plugin) Info() plugins.PluginInfo
func (*Plugin) RegisterRoutes ¶
func (p *Plugin) RegisterRoutes(router *gin.RouterGroup) error
RegisterRoutes exposes the host firewall config and a read-only plan. Saving validates the config but does not yet enforce it.
type Rule ¶
type Rule struct {
ID string `yaml:"id,omitempty" json:"id,omitempty"`
Direction string `yaml:"direction" json:"direction"` // inbound | outbound
Action string `yaml:"action" json:"action"` // allow | deny
Protocol string `yaml:"protocol,omitempty" json:"protocol,omitempty"`
Port int `yaml:"port,omitempty" json:"port,omitempty"`
// CIDR is the source for inbound rules or the destination for outbound rules.
CIDR string `yaml:"cidr,omitempty" json:"cidr,omitempty"`
Description string `yaml:"description,omitempty" json:"description,omitempty"`
}
Source Files