nftables

bundles/bind/metadata.py

@@ -41,6 +41,12 @@ defaults = {
         },
         'zones': set(),
     },
+    'nftables': {
+        'input': {
+            'tcp dport 53 accept',
+            'udp dport 53 accept',
+        },
+    },
     'telegraf': {
         'config': {
             'inputs': {

bundles/dovecot/metadata.py

@@ -13,15 +13,20 @@ defaults = {
             'catdoc':               {}, # catdoc, catppt, xls2csv
         },
     },
+    'dovecot': {
+        'database': {
+            'dbname': 'mailserver',
+            'dbuser': 'mailserver',
+        },
+    },
     'letsencrypt': {
         'reload_after': {
             'dovecot',
         },
     },
-    'dovecot': {
+    'nftables': {
-        'database': {
+        'input': {
-            'dbname': 'mailserver',
+            'tcp dport {143, 993, 4190} accept',
-            'dbuser': 'mailserver',
         },
     },
 }

bundles/icinga2/metadata.py

@@ -20,6 +20,11 @@ defaults = {
             }
         },
     },
+    'nftables': {
+        'input': {
+            'tcp dport 5665 accept',
+        },
+    },
     'postgresql': {
         'databases': {
             'icinga2': {

bundles/influxdb2/metadata.py

@@ -10,6 +10,11 @@ defaults = {
             'deb https://repos.influxdata.com/debian {release} stable',
         },
     },
+    'nftables': {
+        'input': {
+            'tcp dport 8200 accept',
+        },
+    },
     'influxdb': {
         'port': '8200',
         'username': 'admin',

bundles/nftables/files/nftables.conf

@@ -0,0 +1,65 @@
+#!/usr/sbin/nft -f
+
+flush ruleset
+
+table inet filter {
+
+  # INPUT
+
+	chain input {
+		type filter hook input priority 0;
+    policy drop;
+
+    # Allow traffic from established and related packets, drop invalid
+    ct state vmap { established : accept, related : accept, invalid : drop }
+
+    # Allow loopback traffic.
+    iifname lo accept
+
+    # accepting ping (icmp-echo-request) for diagnostic purposes.
+    icmp type echo-request limit rate 5/second accept
+    icmpv6 type { nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept
+
+    # Jump to chain according to layer 3 protocol using a verdict map
+    meta protocol vmap { ip : jump inbound_ipv4, ip6 : jump inbound_ipv6 }
+
+    #rules
+% for rule in sorted(input):
+    ${rule}
+% endfor
+	}
+
+  chain inbound_ipv4 {
+    # accepting ping (icmp-echo-request) for diagnostic purposes.
+    icmp type echo-request limit rate 5/second accept
+  }
+
+  chain inbound_ipv6 {
+    # accept neighbour discovery otherwise connectivity breaks
+    icmpv6 type { nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept
+
+    # accepting ping (icmpv6-echo-request) for diagnostic purposes.
+    icmpv6 type echo-request limit rate 5/second accept
+  }
+
+  # FORWARD
+
+	chain forward {
+		type filter hook forward priority 0;
+
+    #rules
+% for rule in sorted(forward):
+    ${rule}
+% endfor
+	}
+
+  # OUTPUT
+
+	chain output {
+		type filter hook output priority 0;
+
+% for rule in sorted(output):
+    ${rule}
+% endfor
+	}
+}

bundles/nftables/items.py

@@ -0,0 +1,22 @@
+files = {
+    '/etc/nftables.conf': {
+        'content_type': 'mako',
+        'mode': '0755',
+        'context': {
+            'input': node.metadata.get('nftables/input'),
+            'forward': node.metadata.get('nftables/forward'),
+            'output': node.metadata.get('nftables/output'),
+        },
+        'triggers': [
+            'svc_systemd:nftables.service:reload',
+        ],
+    },
+}
+
+svc_systemd = {
+    'nftables.service': {
+        'needs': [
+            'pkg_apt:nftables',
+        ],
+    },
+}

bundles/nftables/metadata.py

@@ -0,0 +1,14 @@
+defaults = {
+    'apt': {
+        'packages': {
+            'nftables': {},
+        },
+    },
+    'nftables': {
+        'input': {
+            'tcp dport 22 accept',
+        },
+        'forward': {},
+        'output': {},
+    },
+}

bundles/nginx/metadata.py

@@ -8,26 +8,12 @@ defaults = {
             'nginx': {},
         },
     },
+    'nftables': {
+        'input': {
+            'tcp dport {80, 443} accept',
+        },
+    },
     'nginx': {
-        'default_vhosts': {
-            '80': {
-                'listen': [
-                    '80',
-                    '[::]:80',
-                ],
-                'location /.well-known/acme-challenge/': {
-                    'alias': '/var/lib/dehydrated/acme-challenges/',
-                },
-                'location /': {
-                    'return': '301 https://$host$request_uri',
-                },
-            },
-            'stub_status': {
-               'listen': '127.0.0.1:22999 default_server',
-               'server_name': '_',
-               'stub_status': '',
-            },
-        },
         'vhosts': {
             # '80': {
             #     'content': 'nginx/80.conf',

bundles/postfix/metadata.py

@@ -11,11 +11,19 @@ defaults = {
             '/var/vmail',
         },
     },
+    'grafana_rows': {
+        'postfix_queue',
+    },
     'letsencrypt': {
         'reload_after': {
             'postfix',
         },
     },
+    'nftables': {
+        'input': {
+            'tcp dport {25, 465, 587} accept',
+        },
+    },
     'telegraf': {
         'config': {
             'inputs': {
@@ -23,7 +31,4 @@ defaults = {
             },
         },
     },
-    'grafana_rows': {
-        'postfix_queue',
-    },
 }

bundles/postgresql/metadata.py

@@ -14,6 +14,11 @@ defaults = {
             '/var/lib/postgresql',
         },
     },
+    'nftables': {
+        'input': {
+            'tcp dport 5432 accept',
+        },
+    },
     'postgresql': {
         'conf': {},
         'roles': {

bundles/wireguard/metadata.py

@@ -17,6 +17,11 @@ defaults = {
             },
         },
     },
+    'nftables': {
+        'input': {
+            'tcp dport 51820 accept',
+        },
+    },
     'wireguard': {
         's2s': {},
         'clients': {},

groups/os/debian.py

@@ -4,6 +4,7 @@
     ],
     'bundles': [
         'apt',
+        'nftables',
     ],
     'metadata': {
         'apt': {