slv-nftableslisted

Deploy an OSS-clean nftables ruleset to any slv-managed host (Hermes, Pythnet RPC, validator, RPC, …). Inventory-driven — mgmt IPs, public ports, and per-port allow lists all come from `~/.slv/inventory.{network}.{role}.yml`, nothing is hardcoded. Atomic + rollback-safe (failed validation restores the previous config) and persistent across reboot. Used by `slv hermes firewall` and `slv pythnet firewall`; the same `cmn/deploy_nftables.yml` playbook works against any inventory.
ValidatorsDAO/slv · ★ 89 · AI & Automation · score 80

Install: claude install-skill ValidatorsDAO/slv

# SLV nftables Skill Inventory-driven nftables ruleset deployer. One playbook (`cmn/deploy_nftables.yml`) serves every slv role — Hermes, Pythnet RPC, Solana RPC, validators — by reading the firewall description from the same inventory that already configures the service itself. ## What it does 1. Renders `/etc/nftables.conf` + fragments under `/etc/nftables.d/` and `/etc/nftables.sets.d/` from Jinja2 templates. 2. Validates the rendered config (`nft -c`) before applying. If validation fails, the previous config is restored and the playbook aborts — you cannot lock yourself out via a bad template. 3. Applies atomically (`nft -f`). 4. Seeds allowlist sets with IPs from inventory, preserving any elements added at runtime with `nft add element …` so re-running the playbook never wipes manual additions. 5. Exports the live ruleset back into `/etc/nftables.conf` and enables `nftables.service` so the same ruleset is restored on reboot. ## Ruleset shape ``` chain input (default: drop) ├─ accept loopback ├─ accept established/related ├─ accept icmp / icmpv6 ├─ banAll_v4 drop (highest priority) ├─ mgmt_ips_v4 accept (full access) ├─ allowAll_v4 accept (runtime additions, full access) ├─ mgmt_ips_v4 → tcp dport ssh_port accept (belt-and-suspenders) ├─ public_tcp_ports / public_udp_ports accept └─ restricted_ports[]: allow_<port>_v4 accept else drop ``` ## Inventory variables | Vari