Denozordec
7a3eae98b1
CI / changes (push) Successful in 12s
CI / commitlint (push) Has been skipped
CI / openapi (push) Successful in 25s
CI / web (push) Successful in 46s
CI / go (push) Successful in 1m15s
CI / bird2 (push) Successful in 18s
CI / release (push) Successful in 3m59s
Introduced a comprehensive firewall blocklist feature, allowing for the management of firewall clients and their associated rules. This includes endpoints for enrolling clients, listing clients and rules, and reporting apply statuses. Enhanced the API to support firewall operations, including the ability to handle block/accept policies. Updated the documentation to reflect these changes and added necessary components in the web UI for better user interaction. Additionally, modified the agent server to support firewall failover and integrated firewall functionality into the existing architecture.
52 lines
2.2 KiB
SQL
52 lines
2.2 KiB
SQL
CREATE TABLE firewall_client (
|
|
id TEXT PRIMARY KEY,
|
|
tenant_id TEXT NOT NULL REFERENCES tenant (id) ON DELETE CASCADE,
|
|
name TEXT NOT NULL,
|
|
hostname TEXT,
|
|
token_prefix TEXT NOT NULL,
|
|
token_hash BLOB NOT NULL,
|
|
status TEXT NOT NULL DEFAULT 'pending',
|
|
enroll_seed_used INTEGER NOT NULL DEFAULT 1,
|
|
last_seen_at TEXT,
|
|
last_seen_at_source TEXT,
|
|
last_seen_ip TEXT,
|
|
last_apply_at TEXT,
|
|
last_apply_status TEXT,
|
|
last_apply_error TEXT,
|
|
last_apply_prefix_count INTEGER DEFAULT 0,
|
|
last_apply_ip_count INTEGER DEFAULT 0,
|
|
last_apply_source TEXT,
|
|
client_version TEXT,
|
|
settings_json TEXT NOT NULL DEFAULT '{}',
|
|
created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
|
|
approved_at TEXT,
|
|
approved_by_api_key_id TEXT,
|
|
revoked_at TEXT,
|
|
CHECK (status IN ('pending', 'approved', 'revoked')),
|
|
CHECK (length(trim(name)) > 0),
|
|
CHECK (length(token_hash) = 32)
|
|
);
|
|
|
|
CREATE UNIQUE INDEX idx_firewall_client_token_hash ON firewall_client (token_hash);
|
|
CREATE INDEX idx_firewall_client_tenant_status ON firewall_client (tenant_id, status);
|
|
CREATE INDEX idx_firewall_client_last_seen ON firewall_client (last_seen_at DESC) WHERE status = 'approved';
|
|
|
|
CREATE TABLE firewall_rule (
|
|
id TEXT PRIMARY KEY,
|
|
tenant_id TEXT NOT NULL REFERENCES tenant (id) ON DELETE CASCADE,
|
|
client_id TEXT REFERENCES firewall_client (id) ON DELETE CASCADE,
|
|
priority INTEGER NOT NULL,
|
|
action TEXT NOT NULL,
|
|
community_id TEXT REFERENCES bgp_community (id) ON DELETE CASCADE,
|
|
comment TEXT,
|
|
created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
|
|
updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
|
|
CHECK (action IN ('block', 'accept')),
|
|
CHECK (priority >= 1 AND priority <= 10000),
|
|
UNIQUE (tenant_id, client_id, priority)
|
|
);
|
|
|
|
CREATE INDEX idx_firewall_rule_tenant_priority ON firewall_rule (tenant_id, priority);
|
|
CREATE INDEX idx_firewall_rule_client ON firewall_rule (client_id) WHERE client_id IS NOT NULL;
|
|
CREATE INDEX idx_firewall_rule_tenant_default ON firewall_rule (tenant_id, priority) WHERE client_id IS NULL;
|