denozord/EvoBGP
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 131 Wiki Activity

feat(firewall): enhance blocklist handling and installation script
CI / changes (push) Successful in 11s
Details
CI / commitlint (push) Has been skipped
Details
CI / openapi (push) Successful in 29s
Details
CI / web (push) Successful in 58s
Details
CI / go (push) Successful in 1m20s
Details
CI / bird2 (push) Successful in 18s
Details
CI / release (push) Successful in 4m37s
Details

Browse Source 
Updated the firewall scripts to improve blocklist handling by introducing a new method for fetching and parsing blocklist data using either `jq` or `python3`. Enhanced the installation script to ensure the presence of required dependencies and provided user guidance for post-approval actions. Additionally, improved logging for applied prefixes and total counts, ensuring better visibility into the firewall's operational status.
This commit is contained in:
Denozordec
2026-07-08 21:45:32 +07:00
parent 68f9d4b832
commit 947d1f0cc4
5 changed files with 228 additions and 86 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/firewall.md
+10
View File
@@ -35,6 +35,16 @@ curl -fsSL https://<api>/v1/firewall/install.sh | \
Файлы: `/etc/evobgp/firewall.conf`, `/usr/local/sbin/evobgp-firewall.sh`, systemd timer `evobgp-firewall.timer`.
После **approve** в UI выполните на сервере (или дождитесь timer):
```bash
sudo rm -f /var/lib/evobgp-firewall/last_hash
sudo /usr/local/sbin/evobgp-firewall.sh
sudo nft list table inet evobgp_blocklist
```
Для парсинга JSON нужен `jq` или `python3` (install.sh ставит `jq` на Debian/Ubuntu при отсутствии).
## Failover через speaker
При `EVOBGP_FIREWALL_FAILOVER_ENABLED=1` на speaker-agent CP реплицирует состояние через `POST /v1/agent/firewall-replicate`. Клиенты используют тот же DNS-домен.