halkyon/deploy/host/wg-halkyon.nft

# The rules around home's end of the tunnel from ramiel (ADR 0039, D9, D17), loaded by
# systemd before the tunnel comes up and deleted after it goes (wg-quick-halkyon.conf),
# so it never runs without them. As /etc/wireguard/wg-halkyon.nft on the instance's host at home
# (root, 0600).
#
# A table of its own, apart from Docker's and ufw's, at a priority before theirs: what it
# drops is dropped whatever they say, and what it accepts still meets their rules after
# it.
#
# - To the host: new connections from ramiel to sshd alone (22, the jump from away),
#   then replies.
# - Through the host: new connections from ramiel to Caddy's 443 alone (172.30.80.2 on
#   edge, where Docker has sent the tunnel address's 443 by then), then replies;
#   nothing to the home network, the other containers or anywhere else.
# - Towards ramiel: replies alone.
#
# IPv4 alone: the tunnel carries no IPv6 (D8).

# Made and deleted first, so loading this again replaces it whole.
table inet halkyon_tunnel {}
delete table inet halkyon_tunnel

table inet halkyon_tunnel {
	chain input {
		type filter hook input priority filter - 1; policy accept;
		iifname "wg-halkyon" ct state established,related accept
		iifname "wg-halkyon" ip saddr 10.61.97.1 tcp dport 22 accept
		iifname "wg-halkyon" drop
	}

	chain forward {
		type filter hook forward priority filter - 1; policy accept;
		iifname "wg-halkyon" ct state established,related accept
		iifname "wg-halkyon" ip saddr 10.61.97.1 ip daddr 172.30.80.2 tcp dport 443 accept
		iifname "wg-halkyon" drop
		oifname "wg-halkyon" ct state established,related accept
		oifname "wg-halkyon" drop
	}

	chain output {
		type filter hook output priority filter - 1; policy accept;
		oifname "wg-halkyon" ct state established,related accept
		oifname "wg-halkyon" drop
	}
}