First version

files/refresh_rules.sh

@@ -0,0 +1,38 @@
+#!/bin/bash
+# Keeps the address set of the time servers up to date, in one atomic
+# nftables transaction. NTP pools answer with different addresses at each
+# query, so the addresses chrony actually picked are added to those resolved
+# here. Web traffic does not need addresses: the local proxy connects by name.
+
+CONF=/etc/contest-firewall
+TMP=$(mktemp)
+mkdir -p /run/contest-firewall
+
+# One run at a time (the timer and a manual run can overlap)
+exec 9> /run/contest-firewall/lock
+flock 9
+
+entries() {
+    sed -e 's/#.*//' -e 's/[[:space:]]//g' "$1" | grep -v '^$'
+}
+
+ntp_addresses() {
+    {
+        for name in $(entries "$CONF/ntp_servers.txt"); do
+            dig +short A "$name"
+        done
+        chronyc -n sources 2>/dev/null | awk '/^\^/ {print $2}'
+    } | grep -E '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$' | sort -u
+}
+
+{
+    echo "flush set inet filter ntp_ips"
+    for ip in $(ntp_addresses); do
+        echo "add element inet filter ntp_ips { $ip }"
+    done
+} > "$TMP"
+
+# Apply atomically, then keep a copy of the active ruleset
+nft -f "$TMP"
+rm -f "$TMP"
+nft list ruleset > /etc/nftables.rules