sysopsandClaude Sonnet 5
1d080904b0
New model.FirewallRule + jsondb CRUD (GetFirewallRules/CreateFirewallRule/ UpdateFirewallRule/DeleteFirewallRule), scoped per server. firewall package now generates a full ruleset (baseline + enabled custom rules) and can apply it live via `nft -f` (firewall.Apply), scoped to a per-server nftables table (wireguard_ui_<serverID>) so applying one server never touches another server's rules or any pre-existing firewall state. New endpoints: GET/POST /servers/:id/firewall/rules, POST .../rules/:ruleId, POST .../rules/:ruleId/delete, POST .../apply (live, admin-only). UI in the All Servers page: rule table with add/delete, ruleset preview, and an "Apply now (live)" button with an explicit confirm() warning before it touches the running firewall. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
22 lines
887 B
Go
22 lines
887 B
Go
package model
|
|
|
|
import "time"
|
|
|
|
// FirewallRule is a single user-defined nftables rule scoped to one server.
|
|
// Rules are combined with the server's baseline (listen-port accept +
|
|
// WireGuard-interface forwarding) to build the full ruleset that gets
|
|
// applied via `nft -f`.
|
|
type FirewallRule struct {
|
|
ID string `json:"id"`
|
|
ServerID string `json:"server_id"`
|
|
Direction string `json:"direction"` // "input" or "forward"
|
|
Protocol string `json:"protocol"` // "tcp", "udp", or "" (any)
|
|
Port string `json:"port"` // e.g. "8080" or "8000-9000", "" = any
|
|
Source string `json:"source"` // optional CIDR, "" = any
|
|
Action string `json:"action"` // "accept", "drop", or "reject"
|
|
Comment string `json:"comment"`
|
|
Enabled bool `json:"enabled"`
|
|
CreatedAt time.Time `json:"created_at"`
|
|
UpdatedAt time.Time `json:"updated_at"`
|
|
}
|