sysopsandClaude Sonnet 5
eb1913d400
New model.IPListEntry + jsondb CRUD, independent of any single WireGuard server. firewall.GenerateGlobalRuleset builds an nftables table (wireguard_ui_global) with allow/block sets evaluated at priority -10 - before every per-server table - so it applies to all traffic on the host, not just WireGuard. Allow entries always win over block entries. firewall.ApplyGlobal loads it live via `nft -f`, scoped to that one table. New "Global Firewall Lists" page (nav entry under Settings): add/delete entries, ruleset preview, "Apply now (live)" with an explicit confirm() warning since this affects the whole host's firewall, not just one server. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
16 lines
549 B
Go
16 lines
549 B
Go
package model
|
|
|
|
import "time"
|
|
|
|
// IPListEntry is a single CIDR/IP entry in the host-wide allow or block
|
|
// list. These are not scoped to a single WireGuard server - they apply to
|
|
// the whole host, evaluated before any per-server firewall rules (see
|
|
// firewall.GlobalTableName / firewall.GenerateGlobalRuleset).
|
|
type IPListEntry struct {
|
|
ID string `json:"id"`
|
|
ListType string `json:"list_type"` // "allow" or "block"
|
|
CIDR string `json:"cidr"`
|
|
Comment string `json:"comment"`
|
|
CreatedAt time.Time `json:"created_at"`
|
|
}
|