modify nodes and bundles for new nftables syntax

bundles/vmhost/items.py

@@ -3,3 +3,24 @@ files = {
         'mode': '0755',
     },
 }
+
+if node.has_bundle('nftables'):
+    # libvirt on debian depends on either iptables or firewalld. Since
+    # we're managing firewall rules using bundlewrap, we don't want either
+    # of thos to interfere. So we install firewalld, then ensure it is
+    # never running. After that, we ensure the bundlewrap managed rules
+    # are active.
+    svc_systemd['firewalld'] = {
+        'running': False,
+        'enabled': False,
+        'masked': True,
+        'needs': {
+            'pkg_apt:firewalld',
+        },
+        'needed_by': {
+            'svc_systemd:nftables',
+        },
+        'triggers': {
+            'svc_systemd:nftables:reload',
+        },
+    }

bundles/vmhost/metadata.py

@@ -28,3 +28,10 @@ if node.os == 'debian' and node.os_version[0] < 11:
 
 if node.has_bundle('zfs'):
     defaults['apt']['packages']['libvirt-daemon-driver-storage-zfs'] = {}
+
+if node.has_bundle('nftables'):
+    defaults['apt']['packages']['firewalld'] = {
+        'needed_by': {
+            'pkg_apt:libvirt-daemon-system',
+        },
+    }