#!/usr/sbin/nft -f
# Alliance Boréale - nftables Configuration
# Generated by Ansible - DO NOT EDIT MANUALLY
# Host: {{ inventory_hostname }}
# Date: {{ ansible_date_time.iso8601 }}

# Flush all rules
flush ruleset

# Main table for filtering
table inet filter {
    # Input chain (incoming traffic)
    chain input {
        type filter hook input priority filter; policy {{ firewall.default_policy | default('drop') }};
        
        # Allow established/related connections
        ct state established,related accept
        
        # Allow loopback
        iif lo accept
        
        # Drop invalid packets
        ct state invalid drop
        
        # Allow ICMP (ping)
        ip protocol icmp icmp type { echo-request, echo-reply } limit rate 10/second accept
        ip6 nexthdr icmpv6 icmpv6 type { echo-request, echo-reply, nd-neighbor-solicit, nd-neighbor-advert } limit rate 10/second accept
        
        # Allow SSH
        tcp dport {{ ssh.port | default(22) }} ct state new limit rate 5/minute accept
        
        # Allow DNS (if DNS server)
{% if 'dns_servers' in group_names %}
        udp dport 53 accept
        tcp dport 53 accept
{% endif %}
        
        # Allow PowerDNS API (internal only)
{% if 'dns_servers' in group_names %}
        ip saddr {{ network.internal_subnet | default('10.0.0.0/8') }} tcp dport 8081 accept
{% endif %}
        
        # Log dropped packets (rate limited)
        limit rate 5/minute log prefix "[nftables INPUT DROP] " level info
        
        # Default: drop
    }
    
    # Forward chain (routed traffic)
    chain forward {
        type filter hook forward priority filter; policy drop;
        
        # Log forwarded packets (if any)
        # log prefix "[nftables FORWARD] " level info
    }
    
    # Output chain (outgoing traffic)
    chain output {
        type filter hook output priority filter; policy accept;
        
        # Allow all outgoing by default
    }
}

# NAT table (if needed in future)
# table ip nat {
#     chain prerouting {
#         type nat hook prerouting priority dstnat; policy accept;
#     }
#     
#     chain postrouting {
#         type nat hook postrouting priority srcnat; policy accept;
#     }
# }