add bundle:oidentd

bundles/oidentd/files/oidentd.conf

@@ -0,0 +1,29 @@
+default {
+    default {
+        deny spoof
+        deny spoof_all
+        deny spoof_privport
+        deny random
+        deny random_numeric
+        deny numeric
+        deny hide
+        deny forward
+    }
+}
+
+user root {
+    default {
+        force reply "nobody"
+    }
+}
+
+% for user, allows in node.metadata.get('oidentd/allows', {}).items():
+user ${user} {
+    default {
+%   for allow in sorted(allows):
+        allow ${allow}
+%   endfor
+    }
+}
+
+% endfor

bundles/oidentd/items.py

@@ -0,0 +1,17 @@
+files = {
+    '/etc/oidentd.conf': {
+        'content_type': 'mako',
+        'triggers': {
+            'svc_systemd:oidentd:restart',
+        },
+    },
+}
+
+svc_systemd = {
+    'oidentd': {
+        'needs': {
+            'pkg_apt:oidentd',
+            'file:/etc/oidentd.conf',
+        },
+    },
+}

bundles/oidentd/metadata.py

@@ -0,0 +1,22 @@
+from bundlewrap.metadata import atomic
+
+defaults = {
+    'apt': {
+        'packages': {
+            'oidentd': {},
+        },
+    },
+}
+
+
+@metadata_reactor.provides(
+    'iptables/port_rules/113',
+)
+def iptables(metadata):
+    return {
+        'iptables': {
+            'port_rules': {
+                '113': atomic(metadata.get('oidentd/restrict-to', set('*'))),
+            },
+        },
+    }