policy

type Config struct {
	// Enabled controls whether policy enforcement is active.
	// Default: true (set by ApplyDefaults).
	Enabled bool `yaml:"enabled"`

	// ChainName is the iptables chain name for firewall rules.
	ChainName string `yaml:"chain_name"`
}

type Enforcer struct {
	// contains filtered or unexported fields
}

type FirewallController interface {
	// EnsureChain creates the named iptables chain if it does not already exist.
	EnsureChain(chain string) error
	// ApplyRules replaces all rules in the named chain atomically.
	ApplyRules(chain string, rules []FirewallRule) error
	// FlushChain removes all rules from the named chain.
	FlushChain(chain string) error
	// DeleteChain deletes the named chain.
	// Implementations must be idempotent: deleting a non-existent chain must return nil.
	DeleteChain(chain string) error
}

type FirewallRule struct {
	Interface string // network interface name
	SrcIP     string // source IP (CIDR or single IP)
	DstIP     string // destination IP (CIDR or single IP)
	Port      int    // destination port (0 = any)
	Protocol  string // "tcp", "udp", or "" (any)
	Action    string // "allow" or "deny"
}

type NftablesController struct {
	// contains filtered or unexported fields
}

type PolicyEngine struct {
	// contains filtered or unexported fields
}

type ReconcileTrigger interface {
	TriggerReconcile()
}