41 lines
1.6 KiB
Text
41 lines
1.6 KiB
Text
|
#!/bin/sh
|
||
|
|
set -eu
|
||
|
|
|
||
|
|
NS=le-app-codex
|
||
|
|
HOST_IF=lecodex-host
|
||
|
|
NS_IF=lecodex-ns
|
||
|
|
|
||
|
|
down() {
|
||
|
|
/usr/bin/nft delete table inet le_app_codex 2>/dev/null || true
|
||
|
|
/usr/bin/nft delete table ip le_app_codex_nat 2>/dev/null || true
|
||
|
|
/usr/bin/ip link delete "$HOST_IF" 2>/dev/null || true
|
||
|
|
/usr/bin/ip netns delete "$NS" 2>/dev/null || true
|
||
|
|
}
|
||
|
|
|
||
|
|
case "${1:-}" in
|
||
|
|
up)
|
||
|
|
test "$(id -u)" -eq 0
|
||
|
|
test -r /etc/le-app-codex-runtime/OPERATOR-INPUTS-APPROVED
|
||
|
|
/usr/bin/grep -q 'elements = { 9\.9\.9\.9, 149\.112\.112\.112 }' /etc/nftables.d/50-le-app-codex.nft
|
||
|
|
/usr/bin/grep -q 'elements = { 74\.67\.173\.56 }' /etc/nftables.d/50-le-app-codex.nft
|
||
|
|
test ! -e /run/netns/$NS
|
||
|
|
! /usr/bin/nft list table inet le_app_codex >/dev/null 2>&1
|
||
|
|
! /usr/bin/nft list table ip le_app_codex_nat >/dev/null 2>&1
|
||
|
|
trap down EXIT HUP INT TERM
|
||
|
|
/usr/bin/ip netns add "$NS"
|
||
|
|
/usr/bin/ip link add "$HOST_IF" type veth peer name "$NS_IF"
|
||
|
|
/usr/bin/ip link set "$NS_IF" netns "$NS"
|
||
|
|
/usr/bin/ip address add 10.200.120.1/30 dev "$HOST_IF"
|
||
|
|
/usr/bin/ip link set "$HOST_IF" up
|
||
|
|
/usr/bin/ip -n "$NS" link set lo up
|
||
|
|
/usr/bin/ip -n "$NS" address add 10.200.120.2/30 dev "$NS_IF"
|
||
|
|
/usr/bin/ip -n "$NS" link set "$NS_IF" up
|
||
|
|
/usr/bin/ip -n "$NS" route add default via 10.200.120.1 dev "$NS_IF"
|
||
|
|
/usr/bin/ip netns exec "$NS" /usr/bin/sysctl -q -w net.ipv6.conf.all.disable_ipv6=1 net.ipv6.conf.default.disable_ipv6=1
|
||
|
|
/usr/bin/nft -f /etc/nftables.d/50-le-app-codex.nft
|
||
|
|
trap - EXIT HUP INT TERM
|
||
|
|
;;
|
||
|
|
down) down ;;
|
||
|
|
*) echo 'usage: le-app-codex-netns up|down' >&2; exit 64 ;;
|
||
|
|
esac
|