From: Matteo Nastasi Date: Wed, 7 Oct 2026 10:15:57 +0000 (+0000) Subject: say how the nftables rules are put in place, and fix the quoting of the heads X-Git-Url: https://mop.ddnsfree.com/gitweb/?a=commitdiff_plain;h=refs%2Fheads%2Fphp84-port-en-remote;p=brisk.git say how the nftables rules are put in place, and fix the quoting of the heads Two things about the nftables file that nothing said, both found by looking inside the debian package: - nftables.service runs with ProtectHome=true, so it reads nothing under /home: the file cannot be included where it is written and has to be copied out of Etc. It was being copied anyway, but for no stated reason. - /etc/nftables.d is not a directory of the nftables package, which ships /etc/nftables.conf alone: it exists only because of the include, so it has to be created and the include added once. And /etc/nftables.conf begins with "flush ruleset", so loading it replaces whatever is active, and the include has to come after that line. The commands now say all of it, both in the head of the generated file and in the list the action prints, and they load /etc/nftables.conf rather than the single file, which is what the service does at boot. Also: the heads of the generated files had "run "INSTALL.sh system" again" written inside an echo "...", so the shell ate the inner quotes. Checked in the container: the action prints the four steps, and the head of the generated file carries them with its quotes intact. Co-Authored-By: Claude Opus 5 (1M context) --- diff --git a/INSTALL.sh b/INSTALL.sh index 4512f8b..e946a0d 100755 --- a/INSTALL.sh +++ b/INSTALL.sh @@ -322,10 +322,17 @@ function nft_conf_gen() { { echo "#!/usr/sbin/nft -f" echo "# brisk /${name}/ - nftables rules of the daemon machine." - echo "# Generated by INSTALL.sh, do not edit: run "INSTALL.sh system" again instead." - echo "# Copy it into /etc/nftables.d/, include that directory from" - echo '# /etc/nftables.conf (include "/etc/nftables.d/*.nft") and load it:' - echo "# $(as_root "nft -c -f /etc/nftables.d/${name}.nft") && $(as_root "nft -f /etc/nftables.d/${name}.nft")" + echo "# Generated by INSTALL.sh, do not edit: run \"INSTALL.sh system\" again instead." + echo "# Copy it into /etc/nftables.d/ - it cannot be included where it is," + echo "# because nftables.service runs with ProtectHome=true and reads nothing" + echo "# under /home - include that directory from /etc/nftables.conf and load it:" + echo "# $(as_root "mkdir -p /etc/nftables.d") ; $(as_root "cp /etc/nftables.d/")" + echo "# add include \"/etc/nftables.d/*.nft\" to /etc/nftables.conf" + echo "# $(as_root "nft -c -f /etc/nftables.conf") && $(as_root "systemctl enable --now nftables")" + echo "# /etc/nftables.d is not a directory of the nftables package: it exists" + echo "# only because of that include. And /etc/nftables.conf begins with" + echo "# \"flush ruleset\", so loading it replaces whatever is active: look at" + echo "# \"nft list ruleset\" first." echo "#" echo "# The table accepts by default and drops only the ports of brisk. With a" echo "# firewall whose policy is drop, an accept here is not enough: the two" @@ -409,7 +416,7 @@ function nginx_conf_gen() { tmp="$(mktemp)" { echo "# brisk ${pfx}/ - nginx, http level. Generated by INSTALL.sh, do not edit:" - echo "# run "INSTALL.sh system" again instead. Include it at http level, for example" + echo "# run \"INSTALL.sh system\" again instead. Include it at http level, for example" echo "# $(as_root "ln -s $http_f /etc/nginx/conf.d/")" echo echo "map \$http_upgrade \$${var}_connection_upgrade {" @@ -474,7 +481,7 @@ EOF tmp="$(mktemp)" { echo "# brisk ${pfx}/ - nginx, inside the server {} that terminates the tls." - echo "# Generated by INSTALL.sh, do not edit: run "INSTALL.sh system" again instead." + echo "# Generated by INSTALL.sh, do not edit: run \"INSTALL.sh system\" again instead." echo "# server {" echo "# listen 443 ssl;" echo "# ..." @@ -802,8 +809,9 @@ if [ "$action" = "system" ]; then else echo "nftables rules:" nft_conf_gen - sys_todo="${sys_todo} $(as_root "cp $etc_path/${scrname}.nft /etc/nftables.d/")\n" - sys_todo="${sys_todo} $(as_root "nft -c -f /etc/nftables.d/${scrname}.nft") && $(as_root "nft -f /etc/nftables.d/${scrname}.nft")\n" + sys_todo="${sys_todo} $(as_root "mkdir -p /etc/nftables.d") ; $(as_root "cp $etc_path/${scrname}.nft /etc/nftables.d/")\n" + sys_todo="${sys_todo} add include \"/etc/nftables.d/*.nft\" to /etc/nftables.conf (once)\n" + sys_todo="${sys_todo} $(as_root "nft -c -f /etc/nftables.conf") && $(as_root "systemctl enable --now nftables")\n" fi # --- how the daemon is started --- diff --git a/WARNING.txt b/WARNING.txt index b79560a..f1b8cc8 100644 --- a/WARNING.txt +++ b/WARNING.txt @@ -27,7 +27,11 @@ say where php-fpm is when it does not run on the same machine. With the daemon on a machine of its own (-m server -U tcp://...), pass -I with the address of the front and the same action writes in Etc .nft, the nftables rules that leave the daemon ports, and php-fpm when it listens -on tcp there, reachable by the front alone. Copy it into /etc/nftables.d/. +on tcp there, reachable by the front alone. It has to be copied out of Etc, +into /etc/nftables.d/: nftables.service runs with ProtectHome=true and reads +nothing under /home. That directory is not part of the nftables package, so +it has to be created and included from /etc/nftables.conf, with the include +AFTER the "flush ruleset" that file begins with - as its last line, say. Everything that belongs to the machine rather than to the tree of the site - these files and the way the daemon is started - comes from that one action,