From 69eff180d4589b9d14d87a766137b0eabbe64f5f Mon Sep 17 00:00:00 2001 From: claude-hdb Date: Mon, 13 Jul 2026 21:30:47 +0000 Subject: [PATCH] fix: setup-host installs nftables when neither nft nor UFW exists MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A stock Debian 13 cloud image ships neither, so the no-UFW firewall path died on its first nft call — on exactly the kind of fresh cloud host the tool targets. Found by the drill; the drill's manual workaround becomes a regression tripwire. Co-Authored-By: Claude Fable 5 --- host/setup-host.sh | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/host/setup-host.sh b/host/setup-host.sh index b72efe8..c3c1f8b 100755 --- a/host/setup-host.sh +++ b/host/setup-host.sh @@ -45,6 +45,11 @@ incus network set claudenet security.acls=claude-isolate \ # which the RFC1918-only ACL cannot express. Rules live in # claudebox-firewall.sh; a boot-time systemd unit re-applies the runtime-only # parts (nft table, DOCKER-USER) after every reboot. +# The no-UFW path drives nft directly, and a stock Debian 13 cloud image ships +# neither nftables nor UFW — install the dependency we are about to use. +if ! command -v ufw >/dev/null 2>&1 && ! command -v nft >/dev/null 2>&1; then + sudo apt-get install -y nftables +fi sudo install -m 755 "$here/host/claudebox-firewall.sh" /usr/local/sbin/claudebox-firewall sudo install -m 644 "$here/host/claudebox-firewall.service" /etc/systemd/system/ sudo systemctl daemon-reload