recipe_firewall.ts

The neutral firewall allow-set shared by the recipe_debian_firewall / recipe_alpine_firewall wrappers.

A web host accepts the same inbound traffic on every distro — SSH, HTTP, and HTTPS — so the rule set is neutral; what differs is the backend (ufw self-persists, nftables needs a companion service to reload its ruleset at boot), which is why the public recipes are the thin debian_web_firewall / alpine_web_firewall wrappers rather than this module.

Pure functions evaluated in zap's sandboxed config eval (fgro eval: no I/O, clock, or randomness); the output is deterministic.

view source

Declarations
#

3 declarations

WEB_FIREWALL_ALLOW
#

recipe_firewall.ts view source

readonly FirewallAllowRule[]

type readonly FirewallAllowRule[]

import {WEB_FIREWALL_ALLOW} from '@fuzdev/zap/recipe_firewall.js';

The standard web-host inbound allow set: SSH (22), HTTP (80), HTTPS (443), all tcp.

Expressed as port/proto rules rather than ufw named profiles ('OpenSSH', 'Nginx Full') so the identical set works on both backends — nftables has no application-profile concept (a named rule under it is a config error zap rejects at plan). One source for "what a web host accepts," shared by both wrappers.

web_firewall_allow_rules
#

recipe_firewall.ts view source

(options?: WebFirewallOptions | undefined): FirewallAllowRule[] import {web_firewall_allow_rules} from '@fuzdev/zap/recipe_firewall.js';

The baseline allow set plus any allow_extra, as a fresh mutable array (the shared firewall.allow both wrappers build on).

options?

type WebFirewallOptions
optional

returns

FirewallAllowRule[]

a new FirewallAllowRule[] — the baseline is never mutated.

WebFirewallOptions
#

Depends on
#

Imported by
#