74 lines
1.8 KiB
Python
74 lines
1.8 KiB
Python
from typing import TYPE_CHECKING
|
|
|
|
from archinstall.lib.log import debug
|
|
from archinstall.lib.models.application import Firewall, FirewallConfiguration
|
|
|
|
if TYPE_CHECKING:
|
|
from archinstall.lib.installer import Installer
|
|
|
|
|
|
class FirewallApp:
|
|
@property
|
|
def ufw_packages(self) -> list[str]:
|
|
return [
|
|
'ufw',
|
|
]
|
|
|
|
@property
|
|
def fwd_packages(self) -> list[str]:
|
|
return [
|
|
'firewalld',
|
|
]
|
|
|
|
@property
|
|
def ufw_services(self) -> list[str]:
|
|
return [
|
|
'ufw.service',
|
|
]
|
|
|
|
@property
|
|
def fwd_services(self) -> list[str]:
|
|
return [
|
|
'firewalld.service',
|
|
]
|
|
|
|
def _allow_ufw_ssh_on_first_boot(self, install_session: Installer) -> None:
|
|
service_content = """[Unit]
|
|
Description=Allow SSH in UFW on first boot
|
|
After=ufw.service
|
|
Wants=ufw.service
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/bin/ufw allow SSH
|
|
ExecStartPost=/usr/bin/systemctl disable ufw-allow-ssh.service
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
"""
|
|
service_path = install_session.target / 'etc/systemd/system/ufw-allow-ssh.service'
|
|
service_path.write_text(service_content)
|
|
install_session.enable_service(['ufw-allow-ssh.service'])
|
|
|
|
def install(
|
|
self,
|
|
install_session: Installer,
|
|
firewall_config: FirewallConfiguration,
|
|
) -> None:
|
|
debug(f'Installing firewall: {firewall_config.firewall.value}')
|
|
|
|
match firewall_config.firewall:
|
|
case Firewall.UFW:
|
|
install_session.add_additional_packages(self.ufw_packages)
|
|
install_session.enable_service(self.ufw_services)
|
|
# write default conf file to enabled
|
|
ufw_conf = install_session.target / 'etc/ufw/ufw.conf'
|
|
ufw_conf.write_text(ufw_conf.read_text().replace('ENABLED=no', 'ENABLED=yes'))
|
|
|
|
if firewall_config.allow_ssh:
|
|
self._allow_ufw_ssh_on_first_boot(install_session)
|
|
|
|
case Firewall.FWD:
|
|
install_session.add_additional_packages(self.fwd_packages)
|
|
install_session.enable_service(self.fwd_services)
|