bundlewrap/bundles/iptables/items.py

67 lines
1.7 KiB
Python
Raw Normal View History

directories = {
'/etc/iptables-rules.d': {
'purge': True,
'triggers': {
'action:iptables_enforce',
},
},
}
files = {
'/etc/systemd/system/iptables-enforce.service': {
'triggers': {
'action:systemd-reload',
},
},
'/usr/local/sbin/iptables-enforce': {
'content_type': 'mako',
'context': repo.libs.tools.resolve_identifier(repo, node.name),
'mode': '0700',
'triggers': {
'action:iptables_enforce',
},
},
}
enforce_deps = {
'directory:/etc/iptables-rules.d',
'file:/usr/local/sbin/iptables-enforce',
}
for bundle, rules in node.metadata.get('iptables/bundle_rules', {}).items():
files[f'/etc/iptables-rules.d/20-{bundle}'] = {
# We must never use sorted() here. Bundles might rely on their order.
'content': '\n'.join(rules) + '\n',
'triggers': {
'action:iptables_enforce',
},
}
enforce_deps.add(f'file:/etc/iptables-rules.d/20-{bundle}')
if 'custom_rules' in node.metadata.get('iptables', {}):
2021-02-12 19:37:36 +00:00
files['/etc/iptables-rules.d/40-custom'] = {
'content': '\n'.join(node.metadata['iptables']['custom_rules']) + '\n',
'triggers': {
'action:iptables_enforce',
},
}
enforce_deps.add('file:/etc/iptables-rules.d/40-custom')
actions = {
'iptables_enforce': {
'command': '/usr/local/sbin/iptables-enforce',
'triggered': True,
'needs': enforce_deps,
},
}
svc_systemd = {
'iptables-enforce': {
'running': None,
'needs': {
'file:/etc/systemd/system/iptables-enforce.service',
},
},
}