#!/usr/sbin/nft -f
# heleos host inbound firewall — managed by Ansible. Do not edit by hand.
#
# We own ONLY the `inet heleos` table. The delete-then-create pattern makes
# re-applying idempotent and never touches Docker's ip/ip6 filter+nat tables.

table inet heleos {}
delete table inet heleos

table inet heleos {
    chain input {
        type filter hook input priority filter; policy drop;

        ct state established,related accept
        ct state invalid drop
        iif "lo" accept

        # ICMP / ICMPv6 (ping + path-MTU discovery)
        ip protocol icmp accept
        ip6 nexthdr ipv6-icmp accept

        # Admin SSH + public web ports
        tcp dport { {{ ssh_port }}{% for p in firewall_allowed_tcp_ports %}, {{ p }}{% endfor %} } accept
    }
}

# Container FORWARD/NAT (east-west isolation + egress) is handled by Docker in
# its own tables plus the heleos-docker-egress service. See the firewall role.