apply, flush and purge take the try lock and fail with ErrPending, which now
names 'tomswall revert' as the recovery after a failed automatic revert. Each
try gets an ID passed to the timer's 'revert --id', so a stale timer cannot
revert a newer try. Adds tests for Revert success/failure/stale ID and for
restoring a present table at the engine level.
Add `tomswall agent`: it pulls this device's compiled config from tomswallapi,
differentially applies it, and reports the applied generation. It caches the
last known-good config and, when the control plane is unreachable, keeps
applying that cache — it never fails closed.
- internal/agent: rendered-config types, HTTP client (fetch + status report),
on-disk cache, on-device DNS resolver for dns sets (honors the device's
configured resolver, fail-safe on lookup failure), and the pull-apply-report
loop behind a mockable Applier.
- Translate the interface-agnostic, address-matched rendered model into native
tomswall config using the "all:<cidr>" any-interface source/dest form, reusing
the existing differential engine. Named-set members are inlined as concrete
addresses (native nft set references are a tracked follow-up).
- cmd/tomswall: wire the `agent` subcommand (flags + TOMSWALL_* env, --once).
- Unit tests: translation, cache, and the don't-fail-closed fallback loop.
- Add DESIGN.md documenting the control-plane architecture.
Spiritual successor to shorewall — manages nftables directly via
google/nftables. Reads a single YAML config covering zones, interfaces,
hosts, policy, rules, snat, and named portgroups. Computes differential
changes against the running nftables state and applies them atomically.
Supports detecting and purging rules added outside of tomswall.
unkin-agent
benvin
unkinben