say how the nftables rules are put in place, and fix the quoting of the heads

Two things about the nftables file that nothing said, both found by looking
inside the debian package:

  - nftables.service runs with ProtectHome=true, so it reads nothing under
    /home: the file cannot be included where it is written and has to be
    copied out of Etc. It was being copied anyway, but for no stated reason.

  - /etc/nftables.d is not a directory of the nftables package, which ships
    /etc/nftables.conf alone: it exists only because of the include, so it
    has to be created and the include added once. And /etc/nftables.conf
    begins with "flush ruleset", so loading it replaces whatever is active,
    and the include has to come after that line.

The commands now say all of it, both in the head of the generated file and
in the list the action prints, and they load /etc/nftables.conf rather than
the single file, which is what the service does at boot.

Also: the heads of the generated files had "run "INSTALL.sh system" again"
written inside an echo "...", so the shell ate the inner quotes.

Checked in the container: the action prints the four steps, and the head of
the generated file carries them with its quotes intact.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

diff --git a/INSTALL.sh b/INSTALL.sh
index 4512f8b9fdcc253053dfb9a73d4643f2d00f2e9d..e946a0d28ebb34eeaa92f3a8f6a159a665765f06 100755 (executable)
--- a/INSTALL.sh
+++ b/INSTALL.sh
@@ -322,10 +322,17 @@ function nft_conf_gen() {
     {
         echo "#!/usr/sbin/nft -f"
         echo "# brisk /${name}/ - nftables rules of the daemon machine."
-        echo "# Generated by INSTALL.sh, do not edit: run "INSTALL.sh system" again instead."
-        echo "# Copy it into /etc/nftables.d/, include that directory from"
-        echo '# /etc/nftables.conf (include "/etc/nftables.d/*.nft") and load it:'
-        echo "#   $(as_root "nft -c -f /etc/nftables.d/${name}.nft") && $(as_root "nft -f /etc/nftables.d/${name}.nft")"
+        echo "# Generated by INSTALL.sh, do not edit: run \"INSTALL.sh system\" again instead."
+        echo "# Copy it into /etc/nftables.d/ - it cannot be included where it is,"
+        echo "# because nftables.service runs with ProtectHome=true and reads nothing"
+        echo "# under /home - include that directory from /etc/nftables.conf and load it:"
+        echo "#   $(as_root "mkdir -p /etc/nftables.d") ; $(as_root "cp <this file> /etc/nftables.d/")"
+        echo "#   add  include \"/etc/nftables.d/*.nft\"  to /etc/nftables.conf"
+        echo "#   $(as_root "nft -c -f /etc/nftables.conf") && $(as_root "systemctl enable --now nftables")"
+        echo "# /etc/nftables.d is not a directory of the nftables package: it exists"
+        echo "# only because of that include. And /etc/nftables.conf begins with"
+        echo "# \"flush ruleset\", so loading it replaces whatever is active: look at"
+        echo "# \"nft list ruleset\" first."
         echo "#"
         echo "# The table accepts by default and drops only the ports of brisk. With a"
         echo "# firewall whose policy is drop, an accept here is not enough: the two"
@@ -409,7 +416,7 @@ function nginx_conf_gen() {
     tmp="$(mktemp)"
     {
         echo "# brisk ${pfx}/ - nginx, http level. Generated by INSTALL.sh, do not edit:"
-        echo "# run "INSTALL.sh system" again instead. Include it at http level, for example"
+        echo "# run \"INSTALL.sh system\" again instead. Include it at http level, for example"
         echo "#   $(as_root "ln -s $http_f /etc/nginx/conf.d/")"
         echo
         echo "map \$http_upgrade \$${var}_connection_upgrade {"
@@ -474,7 +481,7 @@ EOF
     tmp="$(mktemp)"
     {
         echo "# brisk ${pfx}/ - nginx, inside the server {} that terminates the tls."
-        echo "# Generated by INSTALL.sh, do not edit: run "INSTALL.sh system" again instead."
+        echo "# Generated by INSTALL.sh, do not edit: run \"INSTALL.sh system\" again instead."
         echo "#   server {"
         echo "#       listen 443 ssl;"
         echo "#       ..."
@@ -802,8 +809,9 @@ if [ "$action" = "system" ]; then
     else
         echo "nftables rules:"
         nft_conf_gen
-        sys_todo="${sys_todo}  $(as_root "cp $etc_path/${scrname}.nft /etc/nftables.d/")\n"
-        sys_todo="${sys_todo}  $(as_root "nft -c -f /etc/nftables.d/${scrname}.nft") && $(as_root "nft -f /etc/nftables.d/${scrname}.nft")\n"
+        sys_todo="${sys_todo}  $(as_root "mkdir -p /etc/nftables.d") ; $(as_root "cp $etc_path/${scrname}.nft /etc/nftables.d/")\n"
+        sys_todo="${sys_todo}  add  include \"/etc/nftables.d/*.nft\"  to /etc/nftables.conf   (once)\n"
+        sys_todo="${sys_todo}  $(as_root "nft -c -f /etc/nftables.conf") && $(as_root "systemctl enable --now nftables")\n"
     fi
 
     # --- how the daemon is started ---

diff --git a/WARNING.txt b/WARNING.txt
index b79560a54a3f6fdf17f79362e44bfd2e6e246053..f1b8cc84a9af51da338cdd97b25698aee18bc1ee 100644 (file)
--- a/WARNING.txt
+++ b/WARNING.txt
@@ -27,7 +27,11 @@ say where php-fpm is when it does not run on the same machine.
 With the daemon on a machine of its own (-m server -U tcp://...), pass -I
 with the address of the front and the same action writes in Etc <name>.nft,
 the nftables rules that leave the daemon ports, and php-fpm when it listens
-on tcp there, reachable by the front alone. Copy it into /etc/nftables.d/.
+on tcp there, reachable by the front alone. It has to be copied out of Etc,
+into /etc/nftables.d/: nftables.service runs with ProtectHome=true and reads
+nothing under /home. That directory is not part of the nftables package, so
+it has to be created and included from /etc/nftables.conf, with the include
+AFTER the "flush ruleset" that file begins with - as its last line, say.
 
 Everything that belongs to the machine rather than to the tree of the site -
 these files and the way the daemon is started - comes from that one action,