feat: add automatic guest network interface firewall enablement during policy apply operations

Add network_firewall_enabled_value helper to parse and inject firewall=1 into Proxmox network interface config strings, implement enable_guest_firewall_interfaces to update VM/LXC config with firewall=1 on all netX interfaces before writing rules, extend workload_config_url to build config endpoint paths for qemu/lxc guests, add interfaces_enabled field to apply_rules response showing which interfaces were
2026-07-09 19:40:31 +02:00
parent 5302a8bc82
commit 1b81847fc6
3 changed files with 58 additions and 4 deletions
@@ -78,7 +78,7 @@ Minimum practical write privileges for VM/LXC-level firewall rules:

 - `VM.Audit` so NexaFabric can resolve guests and inspect existing rules.
 - `VM.Config.Options` so NexaFabric can enable the guest firewall option before writing rules.
- `VM.Config.Network` on `/vms` or on the narrow VM/LXC paths you want NexaFabric to manage.
+- `VM.Config.Network` on `/vms` or on the narrow VM/LXC paths you want NexaFabric to manage, so NexaFabric can set `firewall=1` on guest network interfaces before writing rules.

 NexaFabric writes only rules that carry a `NexaFabric policy=...` comment marker. During apply it removes and replaces its own marked rules for the selected policy, leaving manually created Proxmox firewall rules untouched.