Explicit priority on rules and policies #8

New Issue

2026-07-26T17:12:50+10:00

benvin commented

2026-07-26 17:12:50 +10:00

Problem. Policy evaluation is "in order; first match wins", but HCL
resources are unordered and tomswallapi_rule exposes no priority field.
Where two rules overlap (one shadows the other), the effective policy depends
on server-assigned ordering — which can silently change on unrelated applies.
For a firewall, nondeterministic rule order is a correctness bug, not a
papercut.

Proposal.

Required priority (int) on tomswallapi_rule and the future policy
resource; compiler sorts by it.
Compiler rejects two overlapping entries with equal priority rather than
picking one.
Rendered per-device output orders rules by priority so the on-device diff is
stable across recompiles.

**Problem.** Policy evaluation is "in order; first match wins", but HCL resources are unordered and `tomswallapi_rule` exposes no priority field. Where two rules overlap (one shadows the other), the effective policy depends on server-assigned ordering — which can silently change on unrelated applies. For a firewall, nondeterministic rule order is a correctness bug, not a papercut. **Proposal.** - Required `priority` (int) on `tomswallapi_rule` and the future policy resource; compiler sorts by it. - Compiler rejects two overlapping entries with equal priority rather than picking one. - Rendered per-device output orders rules by priority so the on-device diff is stable across recompiles.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/terraform-provider-tomswallapi#8

Explicit priority on rules and policies #8

Explicit `priority` on rules and policies #8