sjat
172ae37953
base's inet-filter forward chain is policy-drop; on a Docker host that kills published-port DNAT + inter-container forwarding ON REBOOT (nftables loads default-deny before dockerd). This drop-in (loaded via base's /etc/nftables.d/*.nft include at boot) appends the container-bridge accepts so a rebooted Docker host keeps forwarding. Resolves FRICTION 2026-06-17 #1 and the GREEN half of ADR-025's acceptance test. NB nftables wildcard is br-*, not the iptables br-+. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
58 lines
1.8 KiB
YAML
58 lines
1.8 KiB
YAML
---
|
|
- name: Install prerequisites
|
|
ansible.builtin.apt:
|
|
name: [ca-certificates, curl, gnupg]
|
|
state: present
|
|
update_cache: true
|
|
tags: [packages]
|
|
|
|
- name: Ensure /etc/apt/keyrings exists
|
|
ansible.builtin.file:
|
|
path: /etc/apt/keyrings
|
|
state: directory
|
|
mode: "0755"
|
|
tags: [packages]
|
|
|
|
- name: Add Docker's APT GPG key
|
|
ansible.builtin.get_url:
|
|
url: https://download.docker.com/linux/debian/gpg
|
|
dest: /etc/apt/keyrings/docker.asc
|
|
mode: "0644"
|
|
tags: [packages]
|
|
|
|
- name: Add the Docker APT repository
|
|
ansible.builtin.apt_repository:
|
|
repo: >-
|
|
deb [arch={{ 'amd64' if ansible_architecture == 'x86_64' else ansible_architecture }}
|
|
signed-by=/etc/apt/keyrings/docker.asc]
|
|
https://download.docker.com/linux/debian
|
|
{{ ansible_distribution_release }} stable
|
|
filename: docker
|
|
state: present
|
|
tags: [packages]
|
|
|
|
- name: Install Docker engine + compose plugin
|
|
ansible.builtin.apt:
|
|
name: "{{ docker_host__packages }}"
|
|
state: present
|
|
update_cache: true
|
|
tags: [packages]
|
|
|
|
- name: Ensure the nftables drop-in dir exists (for the container-forward rules)
|
|
ansible.builtin.file:
|
|
path: "{{ docker_host__nftables_dropin_dir }}"
|
|
state: directory
|
|
mode: "0755"
|
|
when: docker_host__forward_dropin | bool
|
|
tags: [firewall]
|
|
|
|
- name: Install the container-forward nftables drop-in (reboot-safe Docker forwarding)
|
|
ansible.builtin.template:
|
|
src: 10-docker-forward.nft.j2
|
|
dest: "{{ docker_host__nftables_dropin_dir }}/10-docker-forward.nft"
|
|
mode: "0644"
|
|
when: docker_host__forward_dropin | bool
|
|
# Not reloaded here: a running host already forwards via Docker's runtime rules, so the
|
|
# drop-in only needs to protect the NEXT boot (loaded by nftables.service). Reloading nft
|
|
# now would flush Docker's NAT (FRICTION 2026-06-17 #4); the boot loads it cleanly.
|
|
tags: [firewall]
|