forked from heavy-duty/box
ca1a759f3a
The UFW block was create-once: gated on 'a DENY on boxnet exists', it pinned every UFW host to the gateway of the FIRST run. A bridge remapped off a colliding subnet (#80's escape hatch) kept its stale 'allow ... to <old-gw> port 53' and never gained the live gateway's, so box->gateway DNS died at box's own deny — the exact stale-carve-out failure #86 rewrote the ACL path to prevent, left standing in the UFW path (#86 review, item 1). The allows now converge on every run: DNS allows aimed anywhere but the live gateway are deleted, then the live set is ensured (ufw skips existing rules, so a fresh host gets the identical five rules and a re-run is a no-op). And the boot fallback GW=10.88.0.1 is gone (#86 review, item 2): with the bridge not yet addressed when the service ran, a BOX_SUBNET host got its carve-out built — and, once converging, converged — for the WRONG gateway, a latent DNS drop. Fail closed instead: an unaddressed bridge leaves the persisted UFW rules exactly as they are (they survive boots on their own, and nothing else in this script needs the gateway — the nft carve-out is interface-scoped) and says so on stderr; the next setup-host run or service restart converges them once the bridge is up. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| box-firewall.service | ||
| box-firewall.sh | ||
| grant-user.sh | ||
| migrate-host.sh | ||
| revoke-user.sh | ||
| setup-host.sh | ||
| teardown-host.sh | ||