firewall: move from iptables to firewalld (nftables)

1 files changed, 18 insertions, 3 deletions

diff --git a/roles/git/files/runner-zola/webhook.sh b/roles/git/files/runner-zola/webhook.sh
index 1c10685..b874233 100755
--- a/roles/git/files/runner-zola/webhook.sh
+++ b/roles/git/files/runner-zola/webhook.sh
@@ -18,9 +18,24 @@ while true; do
     REF=${REF:-main}
 
     if [ ! -d blog ]; then
-        # Use non-redirected port as redirection is handled via PREROUTING
-        # iptables rules and if this hook runs on the same machine the request
-        # packages will not go through the routing chain.
+        # Use non-redirected port to clone repository as the runner executes on
+        # the same machine as the webserver.
+        #
+        # We use a NAT:PREROUTING chain to implement the redirection (dnat).
+        # However as described by the netfilter packet flow and the connection
+        # tracking system (CONNTRACK), the NAT hooks are only traversed for NEW
+        # connections.
+        # For packages originating from the local machine, the connection will
+        # be seen as NEW by the CONNTRACK system on the OUTPUT path and hence
+        # the NAT:OUTPUT hooks will be traversed.
+        # Once the package is looped-back and arrives at the PREROUTING path,
+        # the NAT:PREROUTING rules wont be traversed as the package is already
+        # known to the CONNTRACK system (not NEW).
+        #
+        # We could additionally implement dnat for lo interface on the OUTPUT
+        # path as described here, but we dont do it and just use the actual
+        # port here :^)
+        # https://unix.stackexchange.com/questions/618229/nftables-destination-nat-block-local-access-to-port
         git clone https://git.memzero.de:8443/blog
     fi
     git -C blog submodule init