denozord/EvoFirewall

Fork 0

Files

T

Denozordec d552f4f326

Build and Push EvoFirewall Docker Image / build-and-push (push) Successful in 1m45s

Details

Build and Push EvoFirewall Docker Image / create-release (push) Skipped

Details

feat(api): implement self-update mechanism for Linux agents

- Added a `maybe_self_update` function in `evofw-firewall.sh` to allow agents to pull the latest version of the sync script from the server, enhancing the agent's ability to stay updated.
- Updated the `/v1/agent/sync-script` endpoint to return ETag and script SHA256 headers, enabling efficient caching and conditional requests.
- Modified the agent policy response to include `script_sha256`, providing visibility into the current version of the sync script.
- Enhanced tests to verify the self-update functionality and ensure correct behavior of the sync script endpoint.

These changes improve the maintainability and reliability of Linux agents by enabling automatic updates of critical scripts.

2026-08-15 16:56:00 +07:00

2.3 KiB

Raw Blame History

Архитектура EvoFirewall

Централизованный control plane для firewall-агентов (Linux nft/ipset, MikroTik address-list).

Компоненты

Компонент	Путь	Роль
Web SPA	`apps/web`	ReUI Frame, TanStack Router/Query
API	`apps/api`	Fastify 5, JWT + agent tokens
DB	`packages/db`	Drizzle + SQLite WAL
Shared	`packages/shared`	Zod-контракты, RBAC helpers
UI	`packages/ui`	shadcn primitives `@evofw/ui`
Agents	`apps/api/src/agent-scripts`	install.sh, sync, MikroTik RSC

Потоки

Enroll — POST /v1/agent/enroll + X-EvoFW-Seed → pending agent
Approve — UI/API → status approved
Policy — GET /v1/agent/policy → deny/allow CIDRs + default_action + optional port_rules + hash (apply_version: 3) + script_sha256 (Linux; не в policy.hash)
Linux self-update — timer: GET /v1/agent/sync-script (ETag / If-None-Match) → при новой версии заменить /usr/local/sbin/evofw-firewall.sh и exec до policy
Apply — agent пишет kernel rules (L3 + L4 port ACL на nft), POST /v1/agent/apply-report + stats + optional host_firewall snapshot
Lists refresh — cron каждые 5 мин (json_url / domains / evobgp_community)

Политика

Именованные наборы правил (policy_sets); агенту назначается M:N через agent_policy_sets
Правило в наборе: action: deny | allow + ровно один источник — IP-список (list_id), CIDR или DNS-имя (hostname → A/AAAA, кэш в policy_rule_resolved)
Evaluate: правила всех назначенных enabled-наборов (sort + priority) + ip_overrides
Цепочка ядра всегда: deny → allow → default_action (accept | drop на агенте)
На Linux nft: после allow — Port ACL (close drop, затем open accept) из agent_port_rules
Exact overlap: allow \ deny (conflicts_dropped); deny wins
Overrides, смена наборов, default_action, Port ACL и refresh DNS/lists бампят policy_generation

Auth

Portal SSO app id fw, permissions fw:*
Agent bearer token (sha256 hash в БД)

2.3 KiB Raw Blame History