denozord/EvoFirewall

Fork 0

Files

T

DenozordecandCursor d5784b9f35

Build and Push EvoFirewall Docker Image / build-and-push (push) Successful in 1m48s

Details

Build and Push EvoFirewall Docker Image / create-release (push) Skipped

Details

feat(api, web): enhance agent installation process with invited status and policy support

- Updated the agent enrollment process to include an 'invited' status, allowing for better tracking of agent states.
- Implemented support for install links that can now include an `install_link_id`, facilitating the transition from invited to pending status upon enrollment.
- Enhanced the MikroTik installation script to include the `EvofwInstallLinkId` for better tracking and management.
- Added new API endpoints for fetching agent policies and serving MikroTik-specific installation scripts.
- Improved the web UI to reflect the new agent statuses and provide copyable installation commands for agents.

Co-authored-by: Cursor <[email protected]>

2026-07-21 01:45:38 +07:00

2.5 KiB

Raw Blame History

Agents

Short install (рекомендуется)

В UI /agents → Добавить агента:

Создаётся агент со статусом Invited (сразу виден в таблице) + install-ссылка.
Скопируйте one-liner (колонка Install или Sheet):

Linux:

curl -fsSL https://<cp>/agent-install/<id> | bash

MikroTik:

/tool fetch url="https://<cp>/agent-install/<id>" dst-path=evofw-install.rsc; /import file-name=evofw-install.rsc

После enroll статус станет Pending — одобрите агента (Approve).
Approved — агент синхронизирует политику.

API (auth): POST /api/v1/install-links { "name": "web-01", "platform": "linux" | "mikrotik" }.

Linux (legacy one-liner)

curl -fsSL https://<cp>/v1/agent/install.sh | \
  EVOFW_CP_URL=https://<cp> \
  EVOFW_SEED=<seed> \
  EVOFW_CLIENT_NAME="web-01" \
  bash

Создаёт нового агента со статусом Pending (без Invited).

Файлы: /etc/evofw/agent.conf, /usr/local/sbin/evofw-firewall.sh, timer evofw-firewall.timer (default 1min).

Backend auto-detect: nft → ipset → iptables.

Whitelist: nft chain policy drop + allow set. Blacklist: policy accept + deny set.

MikroTik (RouterOS 7.21+)

В UI /agents → Добавить агента → platform MikroTik. Скопируйте one-liner:

/tool fetch url="https://<cp>/agent-install/<id>" dst-path=evofw-install.rsc; /import file-name=evofw-install.rsc

Или короткий slug: https://<cp>/<slug>.

Install RSC:

Enroll (с install_link_id → агент Invited → Pending).
Создаёт filter-правила evofw-* и address-list EVOFW_DENY / EVOFW_ALLOW.
Scheduler evofw-sync каждую минуту: GET /v1/agent/policy.rsc → /import (списки + режим).

Blacklist: drop по EVOFW_DENY в input и forward.
Whitelist: accept по EVOFW_ALLOW + catch-all drop только в forward (input не закрывается — Winbox/SSH).

Legacy: скачайте /v1/agent/mikrotik-install.rsc, задайте globals EvofwCpUrl, EvofwSeed, EvofwName, опционально EvofwInstallLinkId, затем /import.

Одобрите агента в UI — после Approve sync начнёт применять политику.

Force sync

sudo rm -f /var/lib/evofw/last_hash
sudo /usr/local/sbin/evofw-firewall.sh

2.5 KiB Raw Blame History Unescape Escape