policy

Jul 28, 2026

Changes in this version

type Config

+ func (c *Config) IsEnabled() bool

type Enforcer

+ func (e *Enforcer) Preflight() error

type FirewallController

+ Probe func() error

type NftablesController — linux/amd64

+ func (c *NftablesController) Probe() error

Jul 23, 2026

Changes in this version

+ var ErrInvalidRuleset = errors.New("policy: invalid ruleset")

type FirewallRule

+ PortTo int

Jul 18, 2026

Changes in this version

+ const DefaultChainName

+ func HandlePolicyUpdated(trigger ReconcileTrigger) api.EventHandler

+ func ReconcileHandler(enforcer *Enforcer, wgMgr *wireguard.Manager, ...) reconcile.ReconcileHandler

+ type Config struct

+ ChainName string

+ Enabled bool

+ func (c *Config) ApplyDefaults()

+ func (c *Config) Validate() error

+ type Enforcer struct

+ func NewEnforcer(engine *PolicyEngine, firewall FirewallController, cfg Config, ...) *Enforcer

+ func (e *Enforcer) ApplyFirewallRules(policies []api.Policy, localNodeID string, iface string, ...) error

+ func (e *Enforcer) FilterPeers(peers []api.Peer, policies []api.Policy, localNodeID string) []api.Peer

+ func (e *Enforcer) Teardown() error

+ type FirewallController interface

+ ApplyRules func(chain string, rules []FirewallRule) error

+ DeleteChain func(chain string) error

+ EnsureChain func(chain string) error

+ FlushChain func(chain string) error

+ type FirewallRule struct

+ Action string

+ DstIP string

+ Interface string

+ Port int

+ Protocol string

+ SrcIP string

+ func (r *FirewallRule) Validate() error

+ type NftablesController struct — linux/amd64

+ func NewNftablesController(logger *slog.Logger) *NftablesController

+ func (c *NftablesController) ApplyRules(chain string, rules []FirewallRule) error

+ func (c *NftablesController) DeleteChain(chain string) error

+ func (c *NftablesController) EnsureChain(chain string) error

+ func (c *NftablesController) FlushChain(chain string) error

+ type PolicyEngine struct

+ func NewPolicyEngine(logger *slog.Logger) *PolicyEngine

+ func (e *PolicyEngine) BuildFirewallRules(policies []api.Policy, localNodeID string, iface string, ...) []FirewallRule

+ func (e *PolicyEngine) FilterPeers(peers []api.Peer, policies []api.Policy, localNodeID string) []api.Peer

+ type ReconcileTrigger interface

+ TriggerReconcile func()