wild-cloud/wild-central
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Rename wild-cloud → wild-central for all managed config files and nftables table

Browse Source 
Completes the naming separation: nftables table, rules file, dnsmasq config,
resolved config, systemd unit, sudoers rule, and temp files now all use
the wild-central name.
This commit is contained in:
Paul Payne
2026-07-14 15:31:50 +00:00
parent 282d255c0a
commit 245d260a2b
10 changed files with 61 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
internal/nftables/manager.go
View File

@@ -11,7 +11,7 @@ import (
"github.com/wild-cloud/wild-central/internal/storage"
)
const defaultRulesPath = "/etc/nftables.d/wild-cloud.nft"
const defaultRulesPath = "/etc/nftables.d/wild-central.nft"
// Manager handles nftables rule generation and application
type Manager struct {
@@ -68,15 +68,15 @@ func (m *Manager) Generate(haproxyPorts []int, extraTCPPorts []int, extraUDPPort
var sb strings.Builder
sb.WriteString("# Wild Cloud nftables rules\n")
sb.WriteString("# Managed by Wild Cloud Central API — do not edit manually\n\n")
sb.WriteString("# Wild Central nftables rules\n")
sb.WriteString("# Managed by Wild Central — do not edit manually\n\n")
// Delete and recreate the table so re-applying never accumulates stale set elements.
// The first line ensures the table exists (so delete never errors on first run).
sb.WriteString("table inet wild-cloud {}\n")
sb.WriteString("delete table inet wild-cloud\n\n")
sb.WriteString("table inet wild-central {}\n")
sb.WriteString("delete table inet wild-central\n\n")
sb.WriteString("table inet wild-cloud {\n")
sb.WriteString("table inet wild-central {\n")
sb.WriteString(" # TCP ports allowed through the firewall (HAProxy + extra TCP)\n")
sb.WriteString(" set allowed_tcp_ports {\n")
sb.WriteString(" type inet_service\n")
@@ -148,7 +148,7 @@ func ValidateWANInterface(name string) error {
// On apply failure, rolls back to the previous rules.
func (m *Manager) SafeApply(content string) error {
// Validate syntax
tmpFile := "/tmp/wild-cloud-nft-safeapply.tmp"
tmpFile := "/tmp/wild-central-nft-safeapply.tmp"
if err := os.WriteFile(tmpFile, []byte(content), 0644); err != nil {
return fmt.Errorf("writing validation file: %w", err)
}
@@ -204,7 +204,7 @@ func (m *Manager) verify() error {
// Validation uses a temp file in /tmp (world-writable) to avoid needing
// write permission on the /etc/nftables.d/ directory itself.
func (m *Manager) WriteRules(content string) error {
tempFile := "/tmp/wild-cloud-nft-validate.tmp"
tempFile := "/tmp/wild-central-nft-validate.tmp"
if err := os.WriteFile(tempFile, []byte(content), 0644); err != nil {
return fmt.Errorf("writing temp rules: %w", err)
@@ -224,9 +224,9 @@ func (m *Manager) WriteRules(content string) error {
}
// ApplyRules loads the rules file into the kernel via a systemd oneshot service.
// The wildcloud user has polkit permission to start wild-cloud-nftables-reload.service.
// The wildcloud user has polkit permission to start wild-central-nftables-reload.service.
func (m *Manager) ApplyRules() error {
cmd := exec.Command("systemctl", "start", "wild-cloud-nftables-reload.service")
cmd := exec.Command("systemctl", "start", "wild-central-nftables-reload.service")
output, err := cmd.CombinedOutput()
if err != nil {
return fmt.Errorf("applying nftables rules: %w (output: %s)", err, string(output))
@@ -235,13 +235,13 @@ func (m *Manager) ApplyRules() error {
return nil
}
// WriteDisabledRules writes a rules file that flushes the wild-cloud table,
// removing all Wild Cloud firewall rules from the kernel when applied.
// WriteDisabledRules writes a rules file that flushes the wild-central table,
// removing all Wild Central firewall rules from the kernel when applied.
func (m *Manager) WriteDisabledRules() error {
content := "# Wild Cloud nftables rules — firewall disabled\n" +
"# Managed by Wild Cloud Central API — do not edit manually\n\n" +
"table inet wild-cloud {}\n" +
"delete table inet wild-cloud\n"
content := "# Wild Central nftables rules — firewall disabled\n" +
"# Managed by Wild Central — do not edit manually\n\n" +
"table inet wild-central {}\n" +
"delete table inet wild-central\n"
if err := storage.WriteFileAtomic(m.rulesPath, []byte(content), 0644); err != nil {
return fmt.Errorf("writing disabled rules file: %w", err)
}
@@ -249,10 +249,10 @@ func (m *Manager) WriteDisabledRules() error {
return nil
}
// GetStatus returns the current wild-cloud nftables table as a string.
// GetStatus returns the current wild-central nftables table as a string.
// Uses sudo to allow the wildcloud user to read kernel state.
func (m *Manager) GetStatus() (string, error) {
cmd := exec.Command("sudo", "nft", "list", "table", "inet", "wild-cloud")
cmd := exec.Command("sudo", "nft", "list", "table", "inet", "wild-central")
output, err := cmd.CombinedOutput()
if err != nil {
// Table may not exist yet — not an error