recipe_alpine_firewall.ts

Alpine firewall — the neutral web-host allow set wired to nftables, plus the companion service that makes the ruleset survive a reboot. The neutral rule set lives in recipe_firewall.ts; the Debian sibling is recipe_debian_firewall.ts.

Unlike ufw (which self-persists), the nftables backend writes /etc/nftables.nft and loads it once with nft -f; the nftables service is what reloads it at boot. So this recipe returns both pieces — and zap rejects an nftables firewall with no enabled service: 'nftables' at plan time, so bundling them here makes the correct shape the default rather than something each config has to remember.

Pure function evaluated in zap's sandboxed config eval (fgro eval).

view source

Declarations
#

alpine_web_firewall
#

recipe_alpine_firewall.ts view source

(options?: WebFirewallOptions | undefined): { firewall: Pick<FirewallResource, "allow" | "backend">; service: Pick<ServiceResource, "service" | ... 1 more ... | "running">; } import {alpine_web_firewall} from '@fuzdev/zap/recipe_alpine_firewall.js';

Build the nftables firewall payload and its companion persistence service for a web host (SSH + HTTP + HTTPS).

Spread each piece into its own resource, and make the service depend on the firewall so the ruleset file is written before the service loads it:

const fw = alpine_web_firewall(); zap.firewall({id: 'firewall', ...fw.firewall}); zap.service({id: 'nftables', depends_on: ['firewall'], ...fw.service});

options?

type WebFirewallOptions
optional

returns

{ firewall: Pick<FirewallResource, "allow" | "backend">; service: Pick<ServiceResource, "service" | "enabled" | "running">; }

{firewall, service} — the payloads for a firewall and a service resource.

Depends on
#