bundlewrap/bundles/iptables/items.py

directories = {
    '/etc/iptables-rules.d': {
        'purge': True,
        'triggers': {
            'action:iptables_enforce',
        },
    },
}

files = {
    '/etc/systemd/system/iptables-enforce.service': {
        'triggers': {
            'action:systemd-reload',
        },
    },
    '/usr/local/sbin/iptables-enforce': {
        'content_type': 'mako',
        'context': repo.libs.tools.resolve_identifier(repo, node.name),
        'mode': '0700',
        'triggers': {
            'action:iptables_enforce',
        },
    },
}

enforce_deps = {
    'directory:/etc/iptables-rules.d',
    'file:/usr/local/sbin/iptables-enforce',
}

for bundle, rules in node.metadata.get('iptables/bundle_rules', {}).items():
    files[f'/etc/iptables-rules.d/20-{bundle}'] = {
        # We must never use sorted() here. Bundles might rely on their order.
        'content': '\n'.join(rules) + '\n',
        'triggers': {
            'action:iptables_enforce',
        },
    }
    enforce_deps.add(f'file:/etc/iptables-rules.d/20-{bundle}')

if 'custom_rules' in node.metadata.get('iptables', {}):
    files['/etc/iptables-rules.d/40-custom'] = {
        'content': '\n'.join(node.metadata['iptables']['custom_rules']) + '\n',
        'triggers': {
            'action:iptables_enforce',
        },
    }
    enforce_deps.add('file:/etc/iptables-rules.d/40-custom')


actions = {
    'iptables_enforce': {
        'command': '/usr/local/sbin/iptables-enforce',
        'triggered': True,
        'needs': enforce_deps,
    },
}

svc_systemd = {
    'iptables-enforce': {
        'running': None,
        'needs': {
            'file:/etc/systemd/system/iptables-enforce.service',
        },
    },
}