search

chimera-linux / cports

Chimera ports collection
BSD 2-Clause "Simplified" License
177 stars 118 forks source link

nft stop-command destroys rules not managed by nft config #2578

Closed nekopsykose closed 2 months ago

nekopsykose commented 2 months ago

the stop command does

stop-command = /usr/bin/nft flush ruleset

which means that a mere dinitctl restart nftables destroys all rules, then reruns /etc/nftables.nft

this means it's impossible to use dinitctl restart nftables while having rules that are external to the /etc configuration. libvirt, tailscale, podman, ... all create their own configuration into nft (whether directly or via iptables-nft, the latter of which leave # Warning: table ip6 nat is managed by iptables-nft, do not touch! comments)

technically, this is easily solved by just not using restart and running nft -f /thefile instead (after writing it in a way that it would work to do that), but it would be nice if this stop command was just not ran at all, or only ran for shutdown stop and not restart stop (not sure if this can be changed), since currently this immediately bricks the nft rules otherwise

nekopsykose commented 2 months ago

though given how everyone else seems to do the same thing maybe this is fine as is

nekopsykose commented 2 months ago

hm yea it's fine