<betawaffle>
why is it so difficult to find an exhaustive reference of nftables' syntax
<betawaffle>
their documentation is so scattered and limited
<betawaffle>
i only just found out yesterday that you can use the `include` directive practically anywhere
pie_ has quit [Ping timeout: 265 seconds]
pie_ has joined #nixos-on-your-router
<andi->
I have very special feelings about those people :)
<andi->
One keyword: testing (of nftables without root permissions)
pie_ has quit [Ping timeout: 276 seconds]
pie_ has joined #nixos-on-your-router
<gchristensen>
cransom: cli53 looks complicated
<gchristensen>
and I'm not sure it supports UPSERT
<cransom>
i'm not sure what upsert is
<gchristensen>
UPSERT creates or updates RRs
<gchristensen>
wheres if you CREATE an RR for foo.bar.com 10x, you can end up with 10 records
<cransom>
cli53 rrcreate --apend i think will do that.
<cransom>
or you can --replace
<gchristensen>
oh cool
pie__ has joined #nixos-on-your-router
pie_ has quit [Ping timeout: 268 seconds]
<betawaffle>
andi-: what do you mean?
<andi->
betawaffle: i wanted my nixos config to syntax check my nft rules. It requires root permissions and upstream doesn't plan to change that.
<betawaffle>
ah
<betawaffle>
andi-: i'm working on a nixos module to build nftables configs
<betawaffle>
can you share yours, so i can see what other people are doing?
<andi->
Nice, i gave up after the above experience.. asked if they saw that as issue and they said no.
<andi->
Not even syntax chexcks :/
<betawaffle>
gave up on nftables, or just...
<andi->
Nftables on nixos
<betawaffle>
so you're using iptables on nixos?
<andi->
At least on an nixos module that would fit my standards for merging
<andi->
I do not want to produce invalid syntax — ever.
<betawaffle>
right, but the syntax is pretty easy
<betawaffle>
i think the problem is the -c flag doesn't *only* do syntax checking
<betawaffle>
does iptables provide a way to check syntax? (with or without root)
<betawaffle>
andi-: also, why not just do the syntax check as part of the service unit?
<betawaffle>
not as nice, but at least it won't ever try to activate a faulty config
ar has quit [Remote host closed the connection]
ar has joined #nixos-on-your-router
<andi->
I dont want to push broken code remotely to my servers
<gchristensen>
pkgs.runInLinuxVM
<betawaffle>
it would only be broken from a bug in the module, though
<betawaffle>
unless you're asking users to write their own config snippets
<betawaffle>
in which case... it's their problem
<betawaffle>
and that's possible with basically everything
<gchristensen>
the nginx and prometheus modules validate the configs at build time
<betawaffle>
right, but only because they can
<gchristensen>
validating at build time is a theme of NixOS, one which would be really nice to extend to nftables
<betawaffle>
my idea is to build up the syntax from basic components
<betawaffle>
such that it won't have a chance to be invalid
<gchristensen>
yeah
<gchristensen>
but the nixos module philosophy I like best is they should cover the 80% of use cases really well and allow an extraConfig blob for the remaining 20%
<gchristensen>
and continuing to protect the user in that case would be super good
<betawaffle>
fair enough
<gchristensen>
but yeah, if it doesn't support it it doesn't support it
<betawaffle>
what about iptables?
<betawaffle>
i've never heard of syntax checking for that
<gchristensen>
well if we're just going to stay as sucky as let's save the effort and stick to iptables :P
<betawaffle>
but nftables is strictly better
<gchristensen>
I'm taking a bit more of a hard-lined stance here fwiw
<gchristensen>
going for nftables would be nice
<gchristensen>
going for something that can be validated at build time is even nicer
<cransom>
bpfilter or bust now, amirite?
<gchristensen>
now you're cooking
<betawaffle>
when is bpfilter going to be available and usable?
<betawaffle>
also, bpfilter has no syntax
<gchristensen>
easy to validate :D
<betawaffle>
we should just make a nix interface to netlink... generate rust code that talks to netlink directly
<gchristensen>
bingo
<betawaffle>
also, nixos should give up on perl and bash, just generate rust or c code directly
<gchristensen>
agreed
<betawaffle>
i can't tell if you're serious or not. i'm like 50% serious