- Makefile: add make patch|minor|major (tag + push), dist-build, completions,
and rpm/rpm-package targets.
- packaging/nfpm.yaml + scripts/build-rpm.sh: package the tomswall binary with
bash/zsh completions, the example config, and a systemd agent unit into an RPM.
- packaging/tomswall-agent.service + agent.env: run `tomswall agent` as a
systemd service (CAP_NET_ADMIN/CAP_NET_RAW), configured via /etc/tomswall/agent.env.
- .woodpecker/release.yaml: on v* tag, test -> build -> package RPM -> PUT to the
artifactapi rpm-internal repo. Matches node-lookup conventions.
Spiritual successor to shorewall — manages nftables directly via
google/nftables. Reads a single YAML config covering zones, interfaces,
hosts, policy, rules, snat, and named portgroups. Computes differential
changes against the running nftables state and applies them atomically.
Supports detecting and purging rules added outside of tomswall.
benvin
unkinben