liminix, branch HEAD

update mtdutils to fix musl compilation problems

2025-08-12T19:08:24Z

commit cb43857ecf45feb0351023946f559e8e3343d12a parent 7e6a59631abb177e60cd367270239fe9ba22ea27 Author: Daniel Barlow Date: Tue, 12 Aug 2025 20:08:24 +0100 update mtdutils to fix musl compilation problems

firewall needs the secrets subscriber

2025-08-12T19:07:39Z

commit 7e6a59631abb177e60cd367270239fe9ba22ea27 parent 71b3f3d6d7c778d5c244ef00cd1ed496ac526e47 Author: Daniel Barlow Date: Tue, 12 Aug 2025 20:07:39 +0100 firewall needs the secrets subscriber

chatgpt go 'way

2025-08-11T22:27:23Z

commit 71b3f3d6d7c778d5c244ef00cd1ed496ac526e47 parent 3dde3fff0b698878e2076cd5c24e2584da66d22c Author: Daniel Barlow Date: Mon, 11 Aug 2025 23:27:23 +0100 chatgpt go 'way

maybe this helps

2025-08-11T20:31:57Z

commit 3dde3fff0b698878e2076cd5c24e2584da66d22c parent 6721b71340dc260159cf07f099d42f4cfc9fca82 Author: Daniel Barlow Date: Mon, 11 Aug 2025 21:31:57 +0100 maybe this helps

does this make it build on hydra against nixpkgs unstable

2025-08-11T18:43:24Z

commit 6721b71340dc260159cf07f099d42f4cfc9fca82 parent 92643e03b3252a93179c2be41a321b181aa38bc4 Author: Daniel Barlow Date: Mon, 11 Aug 2025 19:43:24 +0100 does this make it build on hydra against nixpkgs unstable problem: libadwaita fails to build on hydra with the error Gdk-DEBUG: error: XDG_RUNTIME_DIR is invalid or not set in the environment. but it doesn't fail locally with nix-build so I can't easily see if this is a fix

min-copy-closure use rsync instead of rogue as demo package

2025-04-15T11:58:29Z

commit 92643e03b3252a93179c2be41a321b181aa38bc4 parent e55043a5a9f1f1a434755dd6f36206f8ea480803 Author: Daniel Barlow Date: Tue, 15 Apr 2025 12:58:29 +0100 min-copy-closure use rsync instead of rogue as demo package this is to fix the CI job - because rsync builds and rogue presently doesn't

update uboot malta virtio support patch

2025-04-15T11:57:28Z

commit e55043a5a9f1f1a434755dd6f36206f8ea480803 parent bad55a5f66c185814be3ff21c7ab12be64798c69 Author: Daniel Barlow Date: Tue, 15 Apr 2025 12:57:28 +0100 update uboot malta virtio support patch compiler warnings are fatal, so add the header file that declares virtio_init

qemu needs libslirp for user networking

2025-04-15T11:56:37Z

commit bad55a5f66c185814be3ff21c7ab12be64798c69 parent 1977d3b8a18870580223e0521900164fc8216da7 Author: Daniel Barlow Date: Tue, 15 Apr 2025 12:56:37 +0100 qemu needs libslirp for user networking

fix chrony in 25.05

2025-04-14T22:09:33Z

commit 1977d3b8a18870580223e0521900164fc8216da7 parent e1d8c5de61724f851773b3bd5fb29fc550ffaf0a Author: Daniel Barlow Date: Mon, 14 Apr 2025 23:09:33 +0100 fix chrony in 25.05 I'm currently too stupid to work out why it drags in go whenever I enabale libpcap, because pkgs.libpcap works just fine without it

accommodate newer dropbear in nixpkgs 25.05

2025-04-14T21:12:06Z

commit e1d8c5de61724f851773b3bd5fb29fc550ffaf0a parent 6a89b5b4d44a64e960a141427c90650603a877ae Author: Daniel Barlow Date: Mon, 14 Apr 2025 22:12:06 +0100 accommodate newer dropbear in nixpkgs 25.05

qemu 9.2 won't start network devices without romfile option

2025-04-14T20:25:17Z

commit 6a89b5b4d44a64e960a141427c90650603a877ae parent d749538e9eeb04268c6bcd625860c63bb34d4dd7 Author: Daniel Barlow Date: Mon, 14 Apr 2025 21:25:17 +0100 qemu 9.2 won't start network devices without romfile option

remove qemu vga adapter

2025-04-14T20:22:25Z

commit d749538e9eeb04268c6bcd625860c63bb34d4dd7 parent f728b584a2297a2a61b826459f15a8289fa9ca3b Author: Daniel Barlow Date: Mon, 14 Apr 2025 21:22:25 +0100 remove qemu vga adapter it doesn't work with qemu 9.2 (coming soon) but we don't need it anyway

add "nobody" user needed by rp-pppoe

2025-04-13T22:00:47Z

commit f728b584a2297a2a61b826459f15a8289fa9ca3b parent e04724d7fccda9d789a42a654874be4d1b21fb27 Author: Daniel Barlow Date: Sun, 13 Apr 2025 23:00:47 +0100 add "nobody" user needed by rp-pppoe

upgrade rp-pppoe

2025-04-13T14:44:33Z

commit e04724d7fccda9d789a42a654874be4d1b21fb27 parent 2721481ce10c56f70af9a3f9d8eabd3924114c87 Author: Daniel Barlow Date: Sun, 13 Apr 2025 15:44:33 +0100 upgrade rp-pppoe

fix qemu build in nixpksg unstable/25.05

2025-04-03T18:58:22Z

commit 2721481ce10c56f70af9a3f9d8eabd3924114c87 parent fd9f5cb45f37b67d826aae240ba78d9314defe81 Author: Daniel Barlow Date: Thu, 3 Apr 2025 19:58:22 +0100 fix qemu build in nixpksg unstable/25.05

disambiguate expected string

2025-04-12T22:42:07Z

commit fd9f5cb45f37b67d826aae240ba78d9314defe81 parent b3bdb5a9c4a8a43fd3d2dd6e4e1a83b2b87cb13d Author: Daniel Barlow Date: Sat, 12 Apr 2025 23:42:07 +0100 disambiguate expected string "{ lan }" appears only in output "lan" appears also in the command line we send

output-template add lua type() function

2025-04-12T22:40:23Z

commit b3bdb5a9c4a8a43fd3d2dd6e4e1a83b2b87cb13d parent 8e5f3e29a7476ce90a916daf847862076fa6919f Author: Daniel Barlow Date: Sat, 12 Apr 2025 23:40:23 +0100 output-template add lua type() function I hope you never need it, but (1) I did; (2) it's harmless

don't write service properties with null values

2025-04-12T22:39:13Z

commit 8e5f3e29a7476ce90a916daf847862076fa6919f parent 46769563b703adeefd61d7f591ea8faba41cd9b9 Author: Daniel Barlow Date: Sat, 12 Apr 2025 23:39:13 +0100 don't write service properties with null values because serialisation causes them to become empty strings which are not null

think

2025-04-12T21:24:54Z

commit 46769563b703adeefd61d7f591ea8faba41cd9b9 parent 73f1a566c329ad6b8c550331b34456b163d798c2 Author: Daniel Barlow Date: Sat, 12 Apr 2025 22:24:54 +0100 think

massage doc pathnames for publishing

2025-04-09T23:22:29Z

commit 73f1a566c329ad6b8c550331b34456b163d798c2 parent a720f8f1146565f12f2a34c9c4442afdc7794eef Author: Daniel Barlow Date: Thu, 10 Apr 2025 00:22:29 +0100 massage doc pathnames for publishing

intro: subtitles, add irc links

2025-04-08T22:57:20Z

commit a720f8f1146565f12f2a34c9c4442afdc7794eef parent f9f55ee6bc48797cff6eb21836360c6b2f77399d Author: Daniel Barlow Date: Tue, 8 Apr 2025 23:57:20 +0100 intro: subtitles, add irc links

placeholder doc for porting to new device

2025-04-08T22:51:12Z

commit f9f55ee6bc48797cff6eb21836360c6b2f77399d parent 16168dc730ae888c5f791ae7f320b10e8131a2f4 Author: Daniel Barlow Date: Tue, 8 Apr 2025 23:51:12 +0100 placeholder doc for porting to new device

move stuff about implementing modules/services into Developer manual

2025-04-08T22:34:51Z

commit 16168dc730ae888c5f791ae7f320b10e8131a2f4 parent b3f0c3334779a8845e770e71d04b0f2cd6302ca4 Author: Daniel Barlow Date: Tue, 8 Apr 2025 23:34:51 +0100 move stuff about implementing modules/services into Developer manual

add note about Hydra

2025-04-08T20:27:34Z

commit b3f0c3334779a8845e770e71d04b0f2cd6302ca4 parent 2f092e126a6205f79afdc8fa842af2c185129d00 Author: Daniel Barlow Date: Tue, 8 Apr 2025 21:27:34 +0100 add note about Hydra

add appendices for modules/service/outputs generated doc

2025-04-08T20:25:54Z

commit 2f092e126a6205f79afdc8fa842af2c185129d00 parent eb16a35ff3a28cbfb19bbd4df0f2a2fa43defd00 Author: Daniel Barlow Date: Tue, 8 Apr 2025 21:25:54 +0100 add appendices for modules/service/outputs generated doc

convert "supported hardware" to an appendix

2025-04-08T20:24:31Z

commit eb16a35ff3a28cbfb19bbd4df0f2a2fa43defd00 parent 6a7aa0898e09230a989053bdc080e4e94ca2a1cb Author: Daniel Barlow Date: Tue, 8 Apr 2025 21:24:31 +0100 convert "supported hardware" to an appendix

add community and CoC to the manual

2025-04-08T12:27:57Z

commit 6a7aa0898e09230a989053bdc080e4e94ca2a1cb parent a792fab8ac260ab3b57e48fd3ed31798d89d4eba Author: Daniel Barlow Date: Tue, 8 Apr 2025 13:27:57 +0100 add community and CoC to the manual

think

2025-04-07T22:58:36Z

commit a792fab8ac260ab3b57e48fd3ed31798d89d4eba parent 9910ecefc01acfef121dc94dcfa007335b49ccd3 Author: Daniel Barlow Date: Mon, 7 Apr 2025 23:58:36 +0100 think

improve the Contributions section (IMO it's better)

2025-04-07T22:48:08Z

commit 9910ecefc01acfef121dc94dcfa007335b49ccd3 parent 98a377b551d40e6f66b3acc38efffa41a2d1b26f Author: Daniel Barlow Date: Mon, 7 Apr 2025 23:48:08 +0100 improve the Contributions section (IMO it's better)

mess with the outline

2025-04-07T22:40:42Z

commit 98a377b551d40e6f66b3acc38efffa41a2d1b26f parent 9f9a4a2dc76308355febccaed3fee98869b06a85 Author: Daniel Barlow Date: Mon, 7 Apr 2025 23:40:42 +0100 mess with the outline (config and admin now come under a single top-level section)

remove unnecessary words

2025-04-07T22:40:09Z

commit 9f9a4a2dc76308355febccaed3fee98869b06a85 parent 643e2ec37669f68a7943ed6a2a137cbd2c5ceaf0 Author: Daniel Barlow Date: Mon, 7 Apr 2025 23:40:09 +0100 remove unnecessary words

add tiny bit of phram info

2025-04-07T22:39:40Z

commit 643e2ec37669f68a7943ed6a2a137cbd2c5ceaf0 parent 887fe16020ecf83cc68d1460501d9a49bfa65613 Author: Daniel Barlow Date: Mon, 7 Apr 2025 23:39:40 +0100 add tiny bit of phram info

review installation docs

2025-04-07T22:33:10Z

commit 887fe16020ecf83cc68d1460501d9a49bfa65613 parent 6b61ba3b52f3c3b743279b122e24221e49a8ce3e Author: Daniel Barlow Date: Mon, 7 Apr 2025 23:33:10 +0100 review installation docs

move Contributions to the top of the Development section

2025-04-07T20:40:42Z

commit 6b61ba3b52f3c3b743279b122e24221e49a8ce3e parent a0b36be5e46978d022d8dbf6b0880f673c867715 Author: Daniel Barlow Date: Mon, 7 Apr 2025 21:40:42 +0100 move Contributions to the top of the Development section and various minor edits

randomly proofread small sections

2025-04-06T22:53:03Z

commit a0b36be5e46978d022d8dbf6b0880f673c867715 parent 9bc9a077e372ab6de01187e03b4414e28b72bf25 Author: Daniel Barlow Date: Sun, 6 Apr 2025 23:53:03 +0100 randomly proofread small sections

fix refs and raise heading levels in generated hardware doc

2025-04-06T22:46:24Z

commit 9bc9a077e372ab6de01187e03b4414e28b72bf25 parent 9f501018bfeb7948483c0d6aa81d95e157044417 Author: Daniel Barlow Date: Sun, 6 Apr 2025 23:46:24 +0100 fix refs and raise heading levels in generated hardware doc

include all the doc sections in index

2025-04-06T20:38:17Z

commit 9f501018bfeb7948483c0d6aa81d95e157044417 parent de2757b7988fd51cb424e808bcebc56834ed48e3 Author: Daniel Barlow Date: Sun, 6 Apr 2025 21:38:17 +0100 include all the doc sections in index

extract ci doc derivation into its own file

2025-04-06T20:37:18Z

commit de2757b7988fd51cb424e808bcebc56834ed48e3 parent de861a2ee07011114f6434616ccdfdc64a14292e Author: Daniel Barlow Date: Sun, 6 Apr 2025 21:37:18 +0100 extract ci doc derivation into its own file

convert rst to asciidoc

2025-04-06T17:16:53Z

commit de861a2ee07011114f6434616ccdfdc64a14292e parent 936eb1a7cd7661933e381b9013ab5ae6b407c7dd Author: Daniel Barlow Date: Sun, 6 Apr 2025 18:16:53 +0100 convert rst to asciidoc for i in *.rst ; do pandoc -f rst -t asciidoc -o `basename $i .rst`.adoc $i ;done

setup to parse asciidoc

2025-04-06T17:01:33Z

commit 936eb1a7cd7661933e381b9013ab5ae6b407c7dd parent e4aad311a828145b0529d2762d26c74a5557642e Author: Daniel Barlow Date: Sun, 6 Apr 2025 18:01:33 +0100 setup to parse asciidoc

think

2025-04-02T20:09:13Z

commit e4aad311a828145b0529d2762d26c74a5557642e parent 66748269907336196db1ab9f2d3955def44871b1 Author: Daniel Barlow Date: Wed, 2 Apr 2025 21:09:13 +0100 think

think

2025-04-02T20:08:49Z

commit 66748269907336196db1ab9f2d3955def44871b1 parent 97ff2f300926e0d8bcc37aa4f3a2e5f8d93f1078 Author: Daniel Barlow Date: Wed, 2 Apr 2025 21:08:49 +0100 think

think

2025-03-31T22:22:04Z

commit 97ff2f300926e0d8bcc37aa4f3a2e5f8d93f1078 parent 210b41efc0b0d3c27297fa4b1da36937d03ab5dd Author: Daniel Barlow Date: Mon, 31 Mar 2025 23:22:04 +0100 think

improve robustness of ppp readiness notification

2025-03-31T22:17:50Z

commit 210b41efc0b0d3c27297fa4b1da36937d03ab5dd parent 53c6d506cf1a3fbc8df0e298cf6b988c808fdbe5 Author: Daniel Barlow Date: Mon, 31 Mar 2025 23:17:50 +0100 improve robustness of ppp readiness notification there was a race where ip-up could write ifname and then ip6-up could write its outputs and then test ifname and signal ready before ip-up had written the rest of its outputs

dhcp6c subscribe to ppp ifindex

2025-03-31T22:15:28Z

commit 53c6d506cf1a3fbc8df0e298cf6b988c808fdbe5 parent 01fe2159b4a104438ad7ec8bfcd53a87704f9212 Author: Daniel Barlow Date: Mon, 31 Mar 2025 23:15:28 +0100 dhcp6c subscribe to ppp ifindex when the peer bounces ppp, s6 will restart the ppp process but not restart the dependent services (because the service isn't considered to have gone down) so the dependent services need to notice when the outputs from ppp have changed

ppp: write ifindex as output

2025-03-31T22:11:30Z

commit 01fe2159b4a104438ad7ec8bfcd53a87704f9212 parent d7d19b5ed08bb8b046c5b07098dd5750d76de13d Author: Daniel Barlow Date: Mon, 31 Mar 2025 23:11:30 +0100 ppp: write ifindex as output because what happens if the service is restarted but the new ppp0 is a different interface than the old one so that services which had bound to it with the old name are now not getting new data (I am not 100% that this actually happens but it seems like it would be good to avoid it if it does)

dhcp6 client: fix service dir in address and prefix acquirers

2025-03-31T22:06:40Z

commit d7d19b5ed08bb8b046c5b07098dd5750d76de13d parent ee683f22029518227f8e86850f9678eafd13f4b8 Author: Daniel Barlow Date: Mon, 31 Mar 2025 23:06:40 +0100 dhcp6 client: fix service dir in address and prefix acquirers the scripts now expect the actual service dir instead of the .outputs subdir

firewall: fix syntax of icmp v4 rule

2025-03-31T22:03:24Z

commit ee683f22029518227f8e86850f9678eafd13f4b8 parent d9723aeb87b66db09fa50f59a908f953aa3a23cc Author: Daniel Barlow Date: Mon, 31 Mar 2025 23:03:24 +0100 firewall: fix syntax of icmp v4 rule

secrets subscriber: make restart-all work

2025-03-31T22:01:48Z

commit d9723aeb87b66db09fa50f59a908f953aa3a23cc parent 46ed8f01990a6a7374d1049bdb6ca29a9a2d57d7 Author: Daniel Barlow Date: Mon, 31 Mar 2025 23:01:48 +0100 secrets subscriber: make restart-all work

add bandwidth as a service option for ppp (l2tp, pppoe)

2025-03-27T20:23:26Z

commit 46ed8f01990a6a7374d1049bdb6ca29a9a2d57d7 parent dd44fbaec129863befa3a549254c6e3f8d043ba5 Author: Daniel Barlow Date: Thu, 27 Mar 2025 20:23:26 +0000 add bandwidth as a service option for ppp (l2tp, pppoe)

rate limit for v4 icmp

2025-03-27T20:21:48Z

commit dd44fbaec129863befa3a549254c6e3f8d043ba5 parent 89065be6cd462e590c8a9c93104325bc1437701c Author: Daniel Barlow Date: Thu, 27 Mar 2025 20:21:48 +0000 rate limit for v4 icmp

bandwidth is bits/second so divide by 8

2025-03-27T20:21:14Z

commit 89065be6cd462e590c8a9c93104325bc1437701c parent 420320e434d2497f2ad71867c8c4be4f6a8795ba Author: Daniel Barlow Date: Thu, 27 Mar 2025 20:21:14 +0000 bandwidth is bits/second so divide by 8

firewall: remove unused args/names/vars

2025-03-27T18:40:07Z

commit 420320e434d2497f2ad71867c8c4be4f6a8795ba parent 9ecd2b4fb489fe09c4e9683d814010feefc18578 Author: Daniel Barlow Date: Thu, 27 Mar 2025 18:40:07 +0000 firewall: remove unused args/names/vars

think

2025-03-25T23:55:00Z

commit 9ecd2b4fb489fe09c4e9683d814010feefc18578 parent 1a6160bcabd485ce8aca350b22df64434a1d570d Author: Daniel Barlow Date: Tue, 25 Mar 2025 23:55:00 +0000 think

firewall: show how to ratelimit icmp6 to 5% of available bandwidth

2025-03-25T23:53:02Z

commit 1a6160bcabd485ce8aca350b22df64434a1d570d parent b1bf13bb013a278649bb5e89f271963ed8c53d7c Author: Daniel Barlow Date: Tue, 25 Mar 2025 23:53:02 +0000 firewall: show how to ratelimit icmp6 to 5% of available bandwidth it's a little klunky as yet, requires setting properties.bandwidth on the interface service

add svc:directory, mostly for use in debugging messages

2025-03-25T23:47:01Z

commit b1bf13bb013a278649bb5e89f271963ed8c53d7c parent c3f550698de2951208ec74e96ae085548cae3079 Author: Daniel Barlow Date: Tue, 25 Mar 2025 23:47:01 +0000 add svc:directory, mostly for use in debugging messages

watch-outputs fix update logic

2025-03-25T23:44:21Z

commit c3f550698de2951208ec74e96ae085548cae3079 parent 05991225de57c2441a434142c4a35bc6eddd12fa Author: Daniel Barlow Date: Tue, 25 Mar 2025 23:44:21 +0000 watch-outputs fix update logic it was only working by accident, when it worked, which was by no means all of the time note that we unconditionally perform the action (restart or whatever) once we've started and got the initial state of the outputs. That's because we have no idea whether the outputs changed in the interval between the controlled service initially starting and watch-outputs starting, so updates in that interval could be lost

anoia.svc allow open of a service that is not yet running

2025-03-25T23:37:58Z

commit 05991225de57c2441a434142c4a35bc6eddd12fa parent 7ce1c6bb7d2fb61ab81dfa408310fa2711e908c4 Author: Daniel Barlow Date: Tue, 25 Mar 2025 23:37:58 +0000 anoia.svc allow open of a service that is not yet running we change the inotify watcher so that it attempts to monitor /run/service as well as /run/service/foo. If foo doesn't yet exist then that call to addwatch fails, so we need to be looking at the parent if we are to be told when foo gets created

add realpath to lualinux

2025-03-24T22:39:59Z

commit 7ce1c6bb7d2fb61ab81dfa408310fa2711e908c4 parent 8440378a393d1c4b64b48c8a93f68e38bc76d278 Author: Daniel Barlow Date: Mon, 24 Mar 2025 22:39:59 +0000 add realpath to lualinux

anoia: make dirname handle tralning / like posix

2025-03-24T22:37:24Z

commit 8440378a393d1c4b64b48c8a93f68e38bc76d278 parent e5cfd410138c7474e66c26a0831dc1242510f438 Author: Daniel Barlow Date: Mon, 24 Mar 2025 22:37:24 +0000 anoia: make dirname handle tralning / like posix

add nft_limit kmodule for rate limiting in firewall

2025-03-21T21:19:48Z

commit e5cfd410138c7474e66c26a0831dc1242510f438 parent 0ae5689a407563e150ab2159ee76becd35cb9090 Author: Daniel Barlow Date: Fri, 21 Mar 2025 21:19:48 +0000 add nft_limit kmodule for rate limiting in firewall

support maps in firewallgen

2025-03-21T21:19:18Z

commit 0ae5689a407563e150ab2159ee76becd35cb9090 parent 45047dc0237a7b6d5edaa68e4bca101a51cfffb8 Author: Daniel Barlow Date: Fri, 21 Mar 2025 21:19:18 +0000 support maps in firewallgen

squahs falls back

2025-03-21T21:09:05Z

commit 45047dc0237a7b6d5edaa68e4bca101a51cfffb8 parent 3673804b93e5f040921e2840b60e8fddaf63ed69 Author: Daniel Barlow Date: Fri, 21 Mar 2025 21:09:05 +0000 squahs falls back

think

2025-03-21T21:08:17Z

commit 3673804b93e5f040921e2840b60e8fddaf63ed69 parent be03e9e8c8d88fe75cd98a0c03f20b8b67bdad5e Author: Daniel Barlow Date: Fri, 21 Mar 2025 21:08:17 +0000 think

service outputs falls back to properties (untested)

2025-03-18T18:38:04Z

commit be03e9e8c8d88fe75cd98a0c03f20b8b67bdad5e parent 4e51977ae014e26e345304eb405e35a99dbf64f6 Author: Daniel Barlow Date: Tue, 18 Mar 2025 18:38:04 +0000 service outputs falls back to properties (untested)

provide `properties` attr to services

2025-03-12T23:35:56Z

commit 4e51977ae014e26e345304eb405e35a99dbf64f6 parent 2b0972ed73222a104dbe45a330e29a398879e567 Author: Daniel Barlow Date: Wed, 12 Mar 2025 23:35:56 +0000 provide `properties` attr to services properties are similar to outputs, but are different in that they are fixed values (do not change) and are present even when the service is down if the attribute is present and an attrset, this will write the equivalent recursive directory structure to $out/.properties/

svc.open accepts a /nix/store folder not an outputs folder

2025-03-11T00:21:44Z

commit 2b0972ed73222a104dbe45a330e29a398879e567 parent f22237a3b37ed756ca152f096cbc508e6a364246 Author: Daniel Barlow Date: Tue, 11 Mar 2025 00:21:44 +0000 svc.open accepts a /nix/store folder not an outputs folder this mostly makes things simpler

doc: filter src attribute to not rebuild as much

2025-03-10T23:08:37Z

commit f22237a3b37ed756ca152f096cbc508e6a364246 parent 9dc0f2558761a5fe419608e044c9b62bac233f05 Author: Daniel Barlow Date: Mon, 10 Mar 2025 23:08:37 +0000 doc: filter src attribute to not rebuild as much

min-copy-clocure test: ensure sshd up before starting

2025-03-09T21:37:13Z

commit 9dc0f2558761a5fe419608e044c9b62bac233f05 parent 9ab77a7d7e0af144c493e3f054e9a1194bcd04e5 Author: Daniel Barlow Date: Sun, 9 Mar 2025 21:37:13 +0000 min-copy-clocure test: ensure sshd up before starting this test goes wrong intermittently in CI, see if this makes it more reliable

remove unused function

2025-03-09T20:44:35Z

commit 9ab77a7d7e0af144c493e3f054e9a1194bcd04e5 parent c6918fec002e9fcb842903d4dbea2a40622c5bd9 Author: Daniel Barlow Date: Sun, 9 Mar 2025 20:44:35 +0000 remove unused function

firewall: use extraText for zone set contents

2025-03-09T20:42:02Z

commit c6918fec002e9fcb842903d4dbea2a40622c5bd9 parent d4e46dbe2820028f90f122412e90e91bcb3b30e7 Author: Daniel Barlow Date: Sun, 9 Mar 2025 20:42:02 +0000 firewall: use extraText for zone set contents * the lua necessary is quite wordy, but it's less of a hack than post-processing the rules file with pseudo-sed to get rid of `elements = { }` lines * also switch from stop/starting the firewall service to using a signal, so that we don't go briefly offline every time a new interface appears

secrets/subscriber don't depend on the services we're watching

2025-03-09T20:35:40Z

commit d4e46dbe2820028f90f122412e90e91bcb3b30e7 parent d1f87a56e0b1b3e95a744a07574a7496d7d5d55c Author: Daniel Barlow Date: Sun, 9 Mar 2025 20:35:40 +0000 secrets/subscriber don't depend on the services we're watching this means a watched service can stop and start without killing the subscriber, and that we can watch for services that don't yet exist

secrets/subscriber: use correct numbers for signals to s6-svc

2025-03-09T20:34:29Z

commit d1f87a56e0b1b3e95a744a07574a7496d7d5d55c parent 8c39b47caefcbcb0d6890c31cdd1ce90144744ac Author: Daniel Barlow Date: Sun, 9 Mar 2025 20:34:29 +0000 secrets/subscriber: use correct numbers for signals to s6-svc

output-template: allow splicing statements instead of expression

2025-03-05T22:38:48Z

commit 8c39b47caefcbcb0d6890c31cdd1ce90144744ac parent 2c7a16d7926cb854a1904464e0ece1c794d341dc Author: Daniel Barlow Date: Wed, 5 Mar 2025 22:38:48 +0000 output-template: allow splicing statements instead of expression if the text inside the delimiters begins with ; (a semicolon) then the rest of it is expected to be one or more Lua statements. It needs to say `return "foo"` to interpolate anything, as there is no implicit return of the value of the last statement

firewallgen: add extraText param to set

2025-03-05T22:36:35Z

commit 2c7a16d7926cb854a1904464e0ece1c794d341dc parent d6b06abb6317711dcd96456b8e31519fc40bfc5b Author: Daniel Barlow Date: Wed, 5 Mar 2025 22:36:35 +0000 firewallgen: add extraText param to set anything in here is added verbatim to the set definition

delet second copy of output-template

2025-03-02T21:34:02Z

commit d6b06abb6317711dcd96456b8e31519fc40bfc5b parent 6b32aa569ee1f0780e6cd8e4ad57b196d0293df4 Author: Daniel Barlow Date: Sun, 2 Mar 2025 21:34:02 +0000 delet second copy of output-template

think

2025-03-02T21:21:45Z

commit 6b32aa569ee1f0780e6cd8e4ad57b196d0293df4 parent 234d1bd87e01fa00f8401d1e37829017900572bb Author: Daniel Barlow Date: Sun, 2 Mar 2025 21:21:45 +0000 think

basic unit tests for output-template

2025-03-02T21:14:46Z

commit 234d1bd87e01fa00f8401d1e37829017900572bb parent c38f180fb7c40cdd497f617aae409ea3722a2024 Author: Daniel Barlow Date: Sun, 2 Mar 2025 21:14:46 +0000 basic unit tests for output-template

output-template expose table module

2025-03-02T21:14:16Z

commit c38f180fb7c40cdd497f617aae409ea3722a2024 parent 9a8b22997c74cb503b04f9d7361b31a73afacc76 Author: Daniel Barlow Date: Sun, 2 Mar 2025 21:14:16 +0000 output-template expose table module

output-template: pass the tests

2025-03-02T21:09:32Z

commit 9a8b22997c74cb503b04f9d7361b31a73afacc76 parent c32d09bd8398518ee0d5dcf5421a44002a29a36d Author: Daniel Barlow Date: Sun, 2 Mar 2025 21:09:32 +0000 output-template: pass the tests

output-template: run the tests

2025-03-02T21:09:11Z

commit c32d09bd8398518ee0d5dcf5421a44002a29a36d parent 6649ebeccd95848062ca114ec0aee7714eb62c9f Author: Daniel Barlow Date: Sun, 2 Mar 2025 21:09:11 +0000 output-template: run the tests

firewall: use watch-outputs to track changes in zone->interface map

2025-02-28T00:43:20Z

commit 6649ebeccd95848062ca114ec0aee7714eb62c9f parent 929226ed9eaf18fa87d6e3f9cd283b2680d59d58 Author: Daniel Barlow Date: Fri, 28 Feb 2025 00:43:20 +0000 firewall: use watch-outputs to track changes in zone->interface map includes a horrible hack to work around (claimed (by me)) deficiencies in the nftables parser

delete commented code

2025-02-27T20:55:30Z

commit 929226ed9eaf18fa87d6e3f9cd283b2680d59d58 parent a98f026210eb39ded8211cd60e7d9f5ebcc7cffa Author: Daniel Barlow Date: Thu, 27 Feb 2025 20:55:30 +0000 delete commented code

think

2025-02-27T20:54:44Z

commit a98f026210eb39ded8211cd60e7d9f5ebcc7cffa parent f4dc001b711958213654739cd4fa983195a8dcc3 Author: Daniel Barlow Date: Thu, 27 Feb 2025 20:54:44 +0000 think

check firewall zones in pppoe test

2025-02-25T23:32:05Z

commit f4dc001b711958213654739cd4fa983195a8dcc3 parent 024c018262c85860cd07769a579d2d2ed2088681 Author: Daniel Barlow Date: Tue, 25 Feb 2025 23:32:05 +0000 check firewall zones in pppoe test

run the output-template test

2025-02-22T00:10:19Z

commit 024c018262c85860cd07769a579d2d2ed2088681 parent e1293e37785d42519ca262e28087f3ec84218dd1 Author: Daniel Barlow Date: Sat, 22 Feb 2025 00:10:19 +0000 run the output-template test

think

2025-02-21T23:22:39Z

commit e1293e37785d42519ca262e28087f3ec84218dd1 parent 0c406058e9eb939d9d3212fabdbc3b123d635a7e Author: Daniel Barlow Date: Fri, 21 Feb 2025 23:22:39 +0000 think

remove acceotance of udp sport 5 on wan

2025-02-12T21:54:01Z

commit 0c406058e9eb939d9d3212fabdbc3b123d635a7e parent 19d441333c87169685d8a8e8e1ce4127365c5c98 Author: Daniel Barlow Date: Wed, 12 Feb 2025 21:54:01 +0000 remove acceotance of udp sport 5 on wan this was added for replies to dns queries but isn't needed for that purpose as connection tracking does that anyway

remove duplicate rule

2025-02-10T23:50:07Z

commit 19d441333c87169685d8a8e8e1ce4127365c5c98 parent a726c09ae4460db457ee376ddad1d1d610b4f65f Author: Daniel Barlow Date: Mon, 10 Feb 2025 23:50:07 +0000 remove duplicate rule

improve explanaton of reverse path filtering rule

2025-02-10T23:48:29Z

commit a726c09ae4460db457ee376ddad1d1d610b4f65f parent 7e2b0068e6d1714bc7639998e98a176bf79966ca Author: Daniel Barlow Date: Mon, 10 Feb 2025 23:48:29 +0000 improve explanaton of reverse path filtering rule thanks RoS for the references :-)

nixfmt-rfc-style

2025-02-10T21:55:08Z

commit 7e2b0068e6d1714bc7639998e98a176bf79966ca parent 13cc5a89922495931cb1cb45e3bfc66ef6b9fca8 Author: Daniel Barlow Date: Mon, 10 Feb 2025 21:55:08 +0000 nixfmt-rfc-style There is nothing in this commit except for the changes made by nix-shell -p nixfmt-rfc-style --run "nixfmt ." If this has mucked up your open branches then sorry about that. You can probably nixfmt them to match before merging

Merge pull request 'support firewall zones: don't hardcode interface names in rules' (#16) from firescape into main

2025-02-10T21:23:15Z

commit 13cc5a89922495931cb1cb45e3bfc66ef6b9fca8 parent eff255fe1252e3614c99db654c93212db8eb5ab0 Author: dan Date: Mon, 10 Feb 2025 21:23:15 +0000 Merge pull request 'support firewall zones: don't hardcode interface names in rules' (#16) from firescape into main Reviewed-on: https://gti.telent.net/dan/liminix/pulls/16

default firewall zones in gateway profile

2025-02-10T21:16:20Z

commit 3f889c7119145518e43b2f57bb1b9d7b4fdbd01a parent 7f1712503946767b25bb966f8c807f7cbd3b524f Author: Daniel Barlow Date: Mon, 10 Feb 2025 21:16:20 +0000 default firewall zones in gateway profile

firewall: update zones with interface names as they appear

2025-02-10T00:42:27Z

commit 7f1712503946767b25bb966f8c807f7cbd3b524f parent 4bb081ffcf355b7560e5e22763ecffb19f033bb0 Author: Daniel Barlow Date: Mon, 10 Feb 2025 00:42:27 +0000 firewall: update zones with interface names as they appear

export anoia.svc:fileno so it can be used with event loops

2025-02-10T00:41:01Z

commit 4bb081ffcf355b7560e5e22763ecffb19f033bb0 parent 65878135776e1a1955b7d6b8887448b5d46df674 Author: Daniel Barlow Date: Mon, 10 Feb 2025 00:41:01 +0000 export anoia.svc:fileno so it can be used with event loops

WIP add zones to firewall module

2025-02-06T11:57:06Z

commit 65878135776e1a1955b7d6b8887448b5d46df674 parent 1d780de0f1cc8146d7de55b35c04db2390b14b21 Author: Daniel Barlow Date: Thu, 6 Feb 2025 11:57:06 +0000 WIP add zones to firewall module - zones are an attrset of name -> [interface-service] - the firewall will create empty "ifname" sets for each zone name in each address family (ip, ip6) - then watch the interface services, and add the "ifname" outputs to the corresponding sets when they appear This commit only adds the empty sets

add (very basic) set support in firewallgen

2025-02-03T20:46:22Z

commit 1d780de0f1cc8146d7de55b35c04db2390b14b21 parent 8cf602da91cc49acd766f006dbd1029505f83d7c Author: Daniel Barlow Date: Mon, 3 Feb 2025 20:46:22 +0000 add (very basic) set support in firewallgen and add sets for lan/wan/dmz/guest interface names to default firewall rules

think

2025-02-03T19:52:35Z

commit 8cf602da91cc49acd766f006dbd1029505f83d7c parent c92aacc6fd4267d926e520d8c782b9399102c3d3 Author: Daniel Barlow Date: Mon, 3 Feb 2025 19:52:35 +0000 think

firewall rules: use @lan and @wan sets instead of ifnames

2025-02-03T19:51:08Z

commit c92aacc6fd4267d926e520d8c782b9399102c3d3 parent eff255fe1252e3614c99db654c93212db8eb5ab0 Author: Daniel Barlow Date: Mon, 3 Feb 2025 19:51:08 +0000 firewall rules: use @lan and @wan sets instead of ifnames we don't have anything yet to create or populate the sets

boot.expect: sleep more, for gl-ar750

2025-01-28T10:46:33Z

commit eff255fe1252e3614c99db654c93212db8eb5ab0 parent 453baede613641239723b2075c1d9f650788ece9 Author: Daniel Barlow Date: Tue, 28 Jan 2025 10:46:33 +0000 boot.expect: sleep more, for gl-ar750 the bootloader on gl-ar750 loses characters if we shovel them too fast