From: Tom Hughes <tom@compton.nu>
Date: Wed, 25 Aug 2021 17:59:04 +0000 (+0100)
Subject: Merge remote-tracking branch 'github/pull/440'
X-Git-Url: https://git.openstreetmap.org./chef.git/commitdiff_plain/81266af8b7a16edf5d4a30399b8365682c1d225a?hp=e30c611fafff7e77941db17f57edb274144f747b

Merge remote-tracking branch 'github/pull/440'
---

diff --git a/cookbooks/networking/recipes/default.rb b/cookbooks/networking/recipes/default.rb
index c24686d0b..c76d47e3e 100644
--- a/cookbooks/networking/recipes/default.rb
+++ b/cookbooks/networking/recipes/default.rb
@@ -368,6 +368,13 @@ end
 
 package "shorewall"
 
+systemd_service "shorewall-docker" do
+  service "shorewall"
+  dropin "docker"
+  exec_stop "/sbin/shorewall $OPTIONS stop"
+  notifies :restart, "service[shorewall]"
+end
+
 template "/etc/default/shorewall" do
   source "shorewall-default.erb"
   owner "root"
@@ -436,6 +443,14 @@ template "/etc/shorewall/rules" do
   notifies :restart, "service[shorewall]"
 end
 
+template "/etc/shorewall/stoppedrules" do
+  source "shorewall-stoppedrules.erb"
+  owner "root"
+  group "root"
+  mode "644"
+  notifies :restart, "service[shorewall]"
+end
+
 if node[:networking][:firewall][:enabled]
   service "shorewall" do
     action [:enable, :start]
diff --git a/cookbooks/networking/templates/default/shorewall-interfaces.erb b/cookbooks/networking/templates/default/shorewall-interfaces.erb
index b6a721727..3090a47cc 100644
--- a/cookbooks/networking/templates/default/shorewall-interfaces.erb
+++ b/cookbooks/networking/templates/default/shorewall-interfaces.erb
@@ -13,3 +13,4 @@ net	<%= interface[:interface] %>		nosmurfs,tcpflags
 <% end -%>
 <% end -%>
 loc	wg+		nosmurfs,tcpflags
+dock	docker0		bridge
diff --git a/cookbooks/networking/templates/default/shorewall-stoppedrules.erb b/cookbooks/networking/templates/default/shorewall-stoppedrules.erb
new file mode 100644
index 000000000..276e00a4c
--- /dev/null
+++ b/cookbooks/networking/templates/default/shorewall-stoppedrules.erb
@@ -0,0 +1,2 @@
+ACCEPT	-	-
+ACCEPT	-	$FW
diff --git a/cookbooks/networking/templates/default/shorewall-zones.erb b/cookbooks/networking/templates/default/shorewall-zones.erb
index d3d403c95..72e004713 100644
--- a/cookbooks/networking/templates/default/shorewall-zones.erb
+++ b/cookbooks/networking/templates/default/shorewall-zones.erb
@@ -4,6 +4,7 @@
 fw		firewall
 loc		<%= @type %>
 net		<%= @type %>
+dock		<%= @type %>
 osm:net		<%= @type %>
 ucl:osm		<%= @type %>
 ams:osm		<%= @type %>
diff --git a/cookbooks/networking/templates/default/shorewall.conf.erb b/cookbooks/networking/templates/default/shorewall.conf.erb
index 290c73fb6..1ec804b04 100644
--- a/cookbooks/networking/templates/default/shorewall.conf.erb
+++ b/cookbooks/networking/templates/default/shorewall.conf.erb
@@ -166,7 +166,7 @@ DETECT_DNAT_IPADDRS=No
 
 DISABLE_IPV6=No
 
-DOCKER=No
+DOCKER=Yes
 
 DONT_LOAD=