0x25/bbrkn
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Migrate bbrkn from legacy ipset to nftables sets

Browse source 
The gateway (Archie) routes bbrkn domains via nft sets bbrkn_v4/bbrkn_v6
(inet filter), not the legacy ipset. bbrkn was still emitting dead
`ipset=/domain/bbrkn` directives (no such ipset exists) plus a 92-resolve
pointing at 8.8.8.8, both overridden by hand-maintained files on the host.
This makes bbrkn the generator of record for the real scheme.

generate-configs.sh:
- emit `nftset=/domain/$NFTSET_SPEC` (default 4#inet#filter#bbrkn_v4,
  6#inet#filter#bbrkn_v6) into 90-nftset.conf instead of ipset= into
  91-ipset-bbrkn.conf
- DNS_SERVER default 8.8.8.8 -> 127.0.0.1#5350 (host dnsmasq pihole
  delegates bbrkn domains to for VPN resolution + nftset capture)

deploy-to-gateway.sh: two targets, two instances
- 90-nftset.conf -> host /etc/dnsmasq.d (:5350), 92-resolve -> pihole
- full restart of both (dnsmasq SIGHUP does NOT re-read nftset=/server=)
- flush nft sets bbrkn_v4/bbrkn_v6 instead of `ipset flush bbrkn`
- add end-to-end nftset-capture health check via :5350
- rollback restores both files and restarts both instances

Makefile/workflow: rename IPSET_CONF->NFTSET_CONF, add NFTSET_TARGET_DIR
and HOST_DNSMASQ_SVC, DNS_SERVER=127.0.0.1#5350 (escaped `\#` in Make,
quoted in YAML), note runner is ephemeral (cold gekata crawl).

Docs: README + new CLAUDE.md describe the two-dnsmasq / nft-set model;
exit-node DPI failover (10.77.1.2/10.77.2.2) documented as external
(wg-ha.service), not owned by bbrkn.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
goodvin 2026-07-24 23:55:16 +03:00
parent ef30817cf8
commit d81a4ab3b2
6 changed files with 271 additions and 111 deletions
Download patch file Download diff file Expand all files Collapse all files

21
Makefile
View file

@ -3,16 +3,19 @@
# ===============================
# --- Переменные окружения (с дефолтами для локального запуска) ---
IPSET_CONF ?= /tmp/91-ipset-bbrkn.conf
RESOLVE_CONF ?= /tmp/92-resolve-bbrkn.conf
CHROME_SERVER ?= http://10.100.1.2:3000
DOMAINS_FILE ?= domains.txt
DNS_SERVER ?= 8.8.8.8
CACHE_DIR ?= .cache/api
CACHE_TTL_DAYS ?= 15
NFTSET_CONF ?= /tmp/90-nftset.conf
RESOLVE_CONF ?= /tmp/92-resolve-bbrkn.conf
CHROME_SERVER ?= http://10.77.1.2:3000
DOMAINS_FILE ?= domains.txt
# Резолвер, которому pihole делегирует bbrkn-домены (host dnsmasq :5350).
# ВНИМАНИЕ: '#' в Makefile — начало комментария, экранируем как '\#'.
DNS_SERVER ?= 127.0.0.1\#5350
NFTSET_TARGET_DIR ?= /etc/dnsmasq.d
CACHE_DIR ?= .cache/api
CACHE_TTL_DAYS ?= 15
# Экспортируем переменные, чтобы они были доступны внутри shell-скриптов
export IPSET_CONF RESOLVE_CONF CHROME_SERVER DOMAINS_FILE DNS_SERVER CACHE_DIR CACHE_TTL_DAYS
export NFTSET_CONF RESOLVE_CONF CHROME_SERVER DOMAINS_FILE DNS_SERVER NFTSET_TARGET_DIR CACHE_DIR CACHE_TTL_DAYS
# --- Основные цели ---
.PHONY: all clean cache-clean check generate deploy
@ -22,7 +25,7 @@ all: generate deploy
clean:
@echo "🧹 Очистка временных файлов"
@rm -f $(IPSET_CONF) $(RESOLVE_CONF)
@rm -f $(NFTSET_CONF) $(RESOLVE_CONF)
cache-clean:
@echo "🗑 Очистка кэша API ($(CACHE_DIR))"