bundles/pppd: allow dynamic configuration of nftables rules

bundles/pppd/files/ip-up

@@ -3,6 +3,9 @@
 INTERFACE=$1
 
 echo "add rule nat postrouting oif $INTERFACE masquerade" > /etc/nftables-rules.d/90-pppd
+% for rule in sorted(nftables):
+echo "add rule ${rule}" >> /etc/nftables-rules.d/90-pppd
+% endfor
 echo "net.ipv6.conf.$INTERFACE.accept_ra=2" > /etc/sysctl.d/90-pppd.conf
 
 if systemctl is-active nftables;

bundles/pppd/items.py

@@ -59,6 +59,10 @@ files = {
     },
     '/etc/ppp/ip-up.d/nftables': {
         'source': 'ip-up',
+        'content_type': 'mako',
+        'context': {
+            'nftables': node.metadata.get('pppd/nftables-rules.d', set()),
+        },
         'mode': '0755',
     },
     '/etc/ppp/peers/provider': {