bundles/nginx: add iptables rules

bundles/nginx/metadata.py

@@ -124,3 +124,26 @@ def monitoring(metadata):
             },
         },
     }
+
+
+@metadata_reactor
+def iptables(metadata):
+    interfaces = metadata.get('nginx/restrict-to-interfaces', set())
+    iptables = []
+
+    if len(interfaces):
+        for iface in sorted(interfaces):
+            iptables.append(f'iptables -A INPUT -i {iface} -p tcp --dport 80 -j ACCEPT')
+            iptables.append(f'iptables -A INPUT -i {iface} -p tcp --dport 443 -j ACCEPT')
+
+    else:
+        iptables.append('iptables -A INPUT -p tcp --dport 80 -j ACCEPT')
+        iptables.append('iptables -A INPUT -p tcp --dport 443 -j ACCEPT')
+
+    return {
+        'iptables': {
+            'bundle_rules': {
+                'nginx': iptables,
+            },
+        },
+    }