stratum-firewall (0.14) trixie; urgency=medium

  * The name of a guest is read from VM Reactor's own configuration
    (/etc/vm-reactor/guests/<id>.conf, the "name:" line), so the list reads
    "1  vmr1i0  lxc  10.10.10.2  fw: off  no rules  web-ct" instead of a bare
    ID. The rules do not depend on it; without the file the ID is enough.

 -- Stratum Project <stratum@skraba.net>  Mon, 09 Nov 2026 15:05:00 +0100

stratum-firewall (0.13) trixie; urgency=medium

  * The guests of a VM Reactor host have their own screen in Control Desk:
    "Guest firewalls" appears in the menu only when such a guest exists. It
    lists them (interface or MAC, address, firewall on or off, number of
    rules, the name of the guest when VM Reactor's configuration is readable)
    and opens one guest in the same windows the rules of the host use:
    firewall on/off, incoming and outgoing policy, anti-spoofing, logging, a
    rule added in five steps (direction, action, protocol, port, address), a
    rule removed on selection, and the nftables table of the guest shown as it
    is written.

 -- Stratum Project <stratum@skraba.net>  Mon, 09 Nov 2026 14:20:00 +0100

stratum-firewall (0.12) trixie; urgency=medium

  * The firewall of the guests of a VM Reactor host is part of this module:
    nftables, family bridge, table vmreactor - the host side of the virtual
    network card of a guest or, for a Docker application in the NAT network,
    its MAC address. The module owns the rules (/etc/stratum/firewall/guests/
    <id>.json) and VM Reactor only sends what the user set:
    - `guest-set <id>` stores the guest from stdin (JSON: type, interface,
      MAC, address, NAT and its rules) and applies the table;
    - `guest-remove <id>`, `guest-apply`, `guest-list`, `guest-get <id>`;
    - `guest-counters <id>` reads the packets per verdict of its chains back.
    The table is validated with nft -c before it replaces a working one, so a
    bad rule never cuts the guests off. The host firewall (ufw) is untouched.

 -- Stratum Project <stratum@skraba.net>  Mon, 09 Nov 2026 12:10:00 +0100

stratum-firewall (0.11) trixie; urgency=medium

  * Draw the menus, rule editor, confirmations, input prompts and text views
    in the module itself with a native Go TUI instead of the external dialog
    program, so the appearance matches the rest of Stratum and the module
    needs no helper program.
  * Drop the dialog dependency; nothing outside the module is called for a
    window any more.

 -- Stratum Project <stratum@skraba.net>  Sun, 08 Nov 2026 23:16:00 +0100

stratum-firewall (0.10) trixie; urgency=medium

  * Declare the dialog dependency this module uses for its menus.

 -- Stratum Project <stratum@skraba.net>  Sun, 08 Nov 2026 23:10:00 +0100

stratum-firewall (0.09) UNRELEASED; urgency=medium

  * Move rule validation, SSH protection and managed UFW rule removal to Go.
  * Move the command interface, settings, Docker and rollback to Go.

 -- Stratum Project <stratum@skraba.net>  Sat, 07 Nov 2026 12:00:00 +0100

stratum-firewall (0.08) trixie; urgency=medium

  * Rules of modules may allow all traffic on an interface (port "any"),
    e.g. from the WireGuard mesh.

 -- Stratum Project <stratum@skraba.net>  Mon, 26 Oct 2026 18:00:00 +0100

stratum-firewall (0.07) trixie; urgency=medium

  * apply-modules: only the rules of the modules are replaced, and only
    when /etc/stratum/firewall.d changed (much faster for the modules).

 -- Stratum Project <stratum@skraba.net>  Mon, 26 Oct 2026 14:00:00 +0100

stratum-firewall (0.06) trixie; urgency=medium

  * Rules of other modules: /etc/stratum/firewall.d/<module>.rules ("allow"
    for incoming, "route" for forwarded traffic - containers, VPN), applied
    together with the firewall's own rules; shown in status, listening and
    module-rules. New action apply-modules (no confirmation: these rules
    only allow).

 -- Stratum Project <stratum@skraba.net>  Mon, 26 Oct 2026 10:00:00 +0100

stratum-firewall (0.05) trixie; urgency=medium

  * Docker: published container ports follow the firewall rules (chain
    DOCKER-USER, matched by the host port) - setting "docker" protect
    (default) or open; stratum-firewall-docker.service re-applies the rules
    when Docker starts; blocked Docker connections are logged and shown in
    the events; listening services show the containers.
  * port-allowed and docker-mode for stratum-docker.

 -- Stratum Project <stratum@skraba.net>  Fri, 23 Oct 2026 18:00:00 +0200

stratum-firewall (0.04) trixie; urgency=medium

  * Rules with the same match (protocol, port, interface, source) replace
    each other, like in ufw: the lock-out check now sees what ufw really
    does (a "deny ssh" after "limit ssh" replaced it and locked SSH out).

 -- Stratum Project <stratum@skraba.net>  Fri, 23 Oct 2026 16:00:00 +0200

stratum-firewall (0.03) trixie; urgency=medium

  * Lock-out check: a change that would block an open SSH connection is
    refused unless confirmed (STRATUM_FORCE=1, "Apply anyway" in the menu).
  * Events: blocked connections of the last 24 h (top sources, top ports,
    the last 10) - "stratum firewall events" and in the menu.
  * The rollback timer is exact (it fired up to a minute late).

 -- Stratum Project <stratum@skraba.net>  Fri, 23 Oct 2026 15:00:00 +0200

stratum-firewall (0.02) trixie; urgency=medium

  * First working version: host firewall with ufw (module type service).
  * Types workstation, server, hypervisor, vm-guest; settings for policies,
    IPv6, ping, SSH rate limit and logging.
  * Rules with service presets or ports, per interface and source.
  * SSH guard, confirmation with automatic rollback after 60 seconds.
  * Overview of listening services (allowed / blocked), Docker warning.

 -- Stratum Project <stratum@skraba.net>  Fri, 23 Oct 2026 14:00:00 +0200

stratum-firewall (0.01) trixie; urgency=medium

  * Reserved package name - no function yet.

 -- Stratum Project <stratum@skraba.net>  Thu, 22 Oct 2026 22:30:00 +0200
