rework iptables configuration

bundles/icinga2/metadata.py

@@ -1,6 +1,8 @@
 from json import loads
 from os.path import join
 
+from bundlewrap.metadata import atomic
+
 defaults = {
     'apt': {
         'repos': {
@@ -100,25 +102,13 @@ def add_users_from_json(metadata):
 
 
 @metadata_reactor.provides(
-    'iptables/bundle_rules/icinga2',
+    'iptables/port_rules/5665',
 )
 def iptables(metadata):
-    identifiers = metadata.get('icinga2/restrict-to', set())
-    rules = set()
-
-    if identifiers:
-        for identifier in sorted(identifiers):
-            resolved = repo.libs.tools.resolve_identifier(repo, identifier)
-
-            for address in resolved['ipv4']:
-                rules.add(f'iptables -A INPUT -p tcp -s {address} --dport 5665 -j ACCEPT')
-    else:
-        rules.add('iptables -A INPUT -p tcp --dport 5665 -j ACCEPT')
-
     return {
         'iptables': {
-            'bundle_rules': {
-                'icinga2': list(sorted(rules)),
+            'port_rules': {
+                '5665': atomic(metadata.get('icinga2/restrict-to', set())),
             },
         },
     }