The agent now maps the rendered NAT sections into native tomswall config:
- snat/masquerade -> config.SNAT, expanding a rendered rule's egress interface
list and source CIDRs into one native rule per (egress, source) pair (a native
SNAT rule takes a single dest interface); carries address/probability.
- netmap -> config.Netmap (from_net/to_net -> net1/net2 on the resolved interface).
- 1:1 nat -> config.StaticNAT.
Unit-tested end to end from RenderedConfig to config.Config.
Add `tomswall agent`: it pulls this device's compiled config from tomswallapi,
differentially applies it, and reports the applied generation. It caches the
last known-good config and, when the control plane is unreachable, keeps
applying that cache — it never fails closed.
- internal/agent: rendered-config types, HTTP client (fetch + status report),
on-disk cache, on-device DNS resolver for dns sets (honors the device's
configured resolver, fail-safe on lookup failure), and the pull-apply-report
loop behind a mockable Applier.
- Translate the interface-agnostic, address-matched rendered model into native
tomswall config using the "all:<cidr>" any-interface source/dest form, reusing
the existing differential engine. Named-set members are inlined as concrete
addresses (native nft set references are a tracked follow-up).
- cmd/tomswall: wire the `agent` subcommand (flags + TOMSWALL_* env, --once).
- Unit tests: translation, cache, and the don't-fail-closed fallback loop.
- Add DESIGN.md documenting the control-plane architecture.
benvin