Ilker ManapandClaude Opus 5.5
32c3942040
firewall.enabled (default true) is a cluster setting, applied live: the leader sends a Firewall message to every agent when it registers and when the setting or firewall_networks changes, and the agent (root) takes llmgw's nft table out or installs it. A control plane writes the state to /var/lib/llmgw/firewall.json, which llmgw-firewall-sync.path applies as root with `llmgw firewall sync`; server init and server add install the units, `llmgw firewall sync --install` on one set up before. node add and server add put no firewall on a machine while the setting is off. `llmgw wipe` removes llmgw from a machine after listing what goes and asking for its name: units, engines' processes, the nft table, /etc/llmgw, /var/lib/llmgw, the agent's state, the sudo grant, the CA from the trust store, keepalived's configuration when llmgw wrote it, and the users. --models, --store (Patroni member, etcd, or the local database) and --all take more. The console has it under Do. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
47 lines
1.4 KiB
Go
47 lines
1.4 KiB
Go
package config
|
|
|
|
import (
|
|
"fmt"
|
|
"net/netip"
|
|
"strings"
|
|
)
|
|
|
|
// FirewallAllow reads firewall_networks: networks, or single addresses.
|
|
func (s Server) FirewallAllow() ([]netip.Prefix, error) {
|
|
var out []netip.Prefix
|
|
for i, n := range s.FirewallNetworks {
|
|
n = strings.TrimSpace(n)
|
|
if p, err := netip.ParsePrefix(n); err == nil {
|
|
out = append(out, p.Masked())
|
|
continue
|
|
}
|
|
a, err := netip.ParseAddr(n)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("firewall_networks[%d] is %q: a network (10.0.1.0/24) or an address", i, n)
|
|
}
|
|
out = append(out, netip.PrefixFrom(a, a.BitLen()))
|
|
}
|
|
return out, nil
|
|
}
|
|
|
|
// EnginePorts is the range engines listen in on every node.
|
|
func (s Server) EnginePorts() (int, int) {
|
|
if len(s.Control.PortRange) == 2 {
|
|
return s.Control.PortRange[0], s.Control.PortRange[1]
|
|
}
|
|
d := Default().Control.PortRange
|
|
return d[0], d[1]
|
|
}
|
|
|
|
// FirewallSettings is whether llmgw keeps a firewall on the cluster's
|
|
// machines.
|
|
type FirewallSettings struct {
|
|
// Enabled keeps llmgw's internal ports — engines, node exporter, the
|
|
// agents' stream, the mirror, the store — to the cluster's networks on
|
|
// every machine. False removes llmgw's nftables table everywhere, for a
|
|
// site whose own firewall does that job; the rules are kept, and true
|
|
// puts them back. Changed in the cluster's settings, it is in force on
|
|
// every node and control plane within seconds.
|
|
Enabled bool `koanf:"enabled"`
|
|
}
|