firewall

Overview ¶

Package firewall wires the `solo-provisioner network firewall` verbs to the internal/network/firewall manager. The verbs manage the node-agnostic `inet weaver-host-firewall` nftables table: three reserved blocks (the management allowlist, the operator block list, the in-cluster host-service allowance) plus any number of named allow rules.

The verbs split along a deliberate line. Structure — which rules exist, and what protocol each matches — is declared by its own verb (create for the whole table, create-allow-rule for one named rule), so bringing a rule into existence is always explicit. Membership — the addresses and ports inside a rule — is moved by add/remove/set, which refuse an unknown --name so a typo edits nothing rather than declaring something new.