orca/internal/emitter at eadf2cc2c5857f905e33a65f6a318274475eb5a4 - orca

Files

T

Jon Chery 5013209e31 feat(P3): nft SNAT+DNAT + orca init ingress bootstrap (REQ-173)

nft emitter (internal/emitter/nft.go):
- Add DNATTarget field (C-51: validated via net.ParseIP; injection
  guard). Default 127.0.0.1; proxmox native uses LXC bridge IP.
- Add EnableSNAT field (default true for zero-value config).
- Add postrouting masquerade chain (research Topic 1):
  ip saddr 127.0.0.0/8 oifname != lo masquerade
- Shift input/forward priority from filter (=0) to -10 (research
  Topic 2: pve-firewall coexistence — avoids same-priority undefined
  evaluation order).

internal/ingress/bootstrap.go (new):
- BootstrapLocalIngress: mkdir dirs, push step-ca root CA (C-60:
  certpaths.CACertPath not CAPath), render+write traefik static
  config (C-58: preserves traefik-on-public-ip opt-out), render+
  write+apply nft ruleset, pre-create table (C-55: avoids first-
  apply flush-table error), ensure podman container. All non-fatal.

init.go: Step 4d now calls ingress.BootstrapLocalIngress (R-024).
doctor_nft.go: assert postrouting masquerade + priority -10.

Tests: nft_test.go — DNATTarget substitution, invalid DNATTarget
rejection (C-51), EnableSNAT=false omits postrouting, priority -10.

---ci---
project: orca
phase: 3
milestone: v0.14
status: execute
---/ci---

2026-08-10 20:09:26 +00:00

drift_path_test.go

feat(P10b): drift detection (R-018/R-019/R-020, REQ-103..113)

2026-08-07 07:17:41 +00:00

drift_path.go

feat(P10b): drift detection (R-018/R-019/R-020, REQ-103..113)

2026-08-07 07:17:41 +00:00

emitter_test.go

feat(P0c): Job/Service/DaemonSet schemas + emitter interface + systemd stub (REQ-074)

2026-08-05 17:17:02 +00:00

emitter.go

feat(P0c): Job/Service/DaemonSet schemas + emitter interface + systemd stub (REQ-074)