unkinben
2a3eb3b04d
Spiritual successor to shorewall — manages nftables directly via google/nftables. Reads a single YAML config covering zones, interfaces, hosts, policy, rules, snat, and named portgroups. Computes differential changes against the running nftables state and applies them atomically. Supports detecting and purging rules added outside of tomswall.
29 lines
664 B
Go
29 lines
664 B
Go
package config
|
|
|
|
import "fmt"
|
|
|
|
type Host struct {
|
|
Zone string `yaml:"zone"`
|
|
Interface string `yaml:"interface"`
|
|
Addresses []string `yaml:"addresses"`
|
|
Options []string `yaml:"options,omitempty"`
|
|
}
|
|
|
|
func (c *Config) validateHosts() error {
|
|
for i, h := range c.Hosts {
|
|
if h.Zone == "" {
|
|
return fmt.Errorf("host[%d]: zone required", i)
|
|
}
|
|
if _, ok := c.Zones[h.Zone]; !ok {
|
|
return fmt.Errorf("host[%d]: zone %q not defined", i, h.Zone)
|
|
}
|
|
if h.Interface == "" {
|
|
return fmt.Errorf("host[%d]: interface required", i)
|
|
}
|
|
if len(h.Addresses) == 0 {
|
|
return fmt.Errorf("host[%d]: at least one address required", i)
|
|
}
|
|
}
|
|
return nil
|
|
}
|