goodvin
d81a4ab3b2
The gateway (Archie) routes bbrkn domains via nft sets bbrkn_v4/bbrkn_v6 (inet filter), not the legacy ipset. bbrkn was still emitting dead `ipset=/domain/bbrkn` directives (no such ipset exists) plus a 92-resolve pointing at 8.8.8.8, both overridden by hand-maintained files on the host. This makes bbrkn the generator of record for the real scheme. generate-configs.sh: - emit `nftset=/domain/$NFTSET_SPEC` (default 4#inet#filter#bbrkn_v4, 6#inet#filter#bbrkn_v6) into 90-nftset.conf instead of ipset= into 91-ipset-bbrkn.conf - DNS_SERVER default 8.8.8.8 -> 127.0.0.1#5350 (host dnsmasq pihole delegates bbrkn domains to for VPN resolution + nftset capture) deploy-to-gateway.sh: two targets, two instances - 90-nftset.conf -> host /etc/dnsmasq.d (:5350), 92-resolve -> pihole - full restart of both (dnsmasq SIGHUP does NOT re-read nftset=/server=) - flush nft sets bbrkn_v4/bbrkn_v6 instead of `ipset flush bbrkn` - add end-to-end nftset-capture health check via :5350 - rollback restores both files and restarts both instances Makefile/workflow: rename IPSET_CONF->NFTSET_CONF, add NFTSET_TARGET_DIR and HOST_DNSMASQ_SVC, DNS_SERVER=127.0.0.1#5350 (escaped `\#` in Make, quoted in YAML), note runner is ephemeral (cold gekata crawl). Docs: README + new CLAUDE.md describe the two-dnsmasq / nft-set model; exit-node DPI failover (10.77.1.2/10.77.2.2) documented as external (wg-ha.service), not owned by bbrkn. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
57 lines
2.2 KiB
Makefile
57 lines
2.2 KiB
Makefile
# ===============================
|
||
# Makefile для управления dnsmasq-конфигами
|
||
# ===============================
|
||
|
||
# --- Переменные окружения (с дефолтами для локального запуска) ---
|
||
NFTSET_CONF ?= /tmp/90-nftset.conf
|
||
RESOLVE_CONF ?= /tmp/92-resolve-bbrkn.conf
|
||
CHROME_SERVER ?= http://10.77.1.2:3000
|
||
DOMAINS_FILE ?= domains.txt
|
||
# Резолвер, которому pihole делегирует bbrkn-домены (host dnsmasq :5350).
|
||
# ВНИМАНИЕ: '#' в Makefile — начало комментария, экранируем как '\#'.
|
||
DNS_SERVER ?= 127.0.0.1\#5350
|
||
NFTSET_TARGET_DIR ?= /etc/dnsmasq.d
|
||
CACHE_DIR ?= .cache/api
|
||
CACHE_TTL_DAYS ?= 15
|
||
|
||
# Экспортируем переменные, чтобы они были доступны внутри shell-скриптов
|
||
export NFTSET_CONF RESOLVE_CONF CHROME_SERVER DOMAINS_FILE DNS_SERVER NFTSET_TARGET_DIR CACHE_DIR CACHE_TTL_DAYS
|
||
|
||
# --- Основные цели ---
|
||
.PHONY: all clean cache-clean check generate deploy
|
||
|
||
all: generate deploy
|
||
@echo "✅ Конфиги успешно сгенерированы и задеплоены"
|
||
|
||
clean:
|
||
@echo "🧹 Очистка временных файлов"
|
||
@rm -f $(NFTSET_CONF) $(RESOLVE_CONF)
|
||
|
||
cache-clean:
|
||
@echo "🗑 Очистка кэша API ($(CACHE_DIR))"
|
||
@rm -rf $(CACHE_DIR)
|
||
@echo "✔ Кэш очищен"
|
||
|
||
check:
|
||
@echo "🔍 Проверка файла доменов ($(DOMAINS_FILE))"
|
||
@if [ ! -f "$(DOMAINS_FILE)" ]; then \
|
||
echo "Ошибка: файл $(DOMAINS_FILE) не найден"; \
|
||
exit 1; \
|
||
fi
|
||
@grep -v '^#' $(DOMAINS_FILE) | grep -v '^$$' | while read domain; do \
|
||
if ! echo "$$domain" | grep -qE '^[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$$'; then \
|
||
echo "Ошибка: Неверный формат домена: $$domain"; \
|
||
exit 1; \
|
||
fi \
|
||
done
|
||
@echo "✔ Файл доменов прошёл проверку"
|
||
|
||
generate:
|
||
@echo "⚙ Генерация dnsmasq-конфигов"
|
||
@chmod +x scripts/generate-configs.sh
|
||
@./scripts/generate-configs.sh
|
||
|
||
deploy:
|
||
@echo "🚀 Деплой конфигов в систему"
|
||
@chmod +x scripts/deploy-to-gateway.sh
|
||
@./scripts/deploy-to-gateway.sh
|