Make rc-update service enabling idempotent - #2
Merged
roemer2201 merged 14 commits intoJul 6, 2026
Conversation
'rc-update add' exits non-zero when the service is already installed in the runlevel, which killed the script (set -e) on a second run. Check the OpenRC runlevel symlink first via a small enable_service helper. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015eHMkP8gw2XMC4ikGMNAw8
The README recommends skipping eth0 during setup-alpine, so the interface had no address until reboot. dnsmasq (bind-interfaces + listen-address) then failed to bind and the script aborted before 'lbu commit', losing the whole configuration on diskless installs. Cycle the interface with ifdown/ifup right after writing /etc/network/interfaces so the new config is applied immediately. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015eHMkP8gw2XMC4ikGMNAw8
sysctl -p exits non-zero if a key is unavailable (e.g. net.ipv6.* with the IPv6 module not loaded), which killed the script under set -e. Use sysctl -e to ignore unknown keys and downgrade remaining errors to a warning. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015eHMkP8gw2XMC4ikGMNAw8
The forward accept and masquerade rules matched only on interfaces, so packets with spoofed source addresses were forwarded and NATed too. Require -s $LAN_NET on both rules (the variable was previously unused). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015eHMkP8gw2XMC4ikGMNAw8
Extend PRIVATE_NETS with 0/8, loopback, 192.0.0/24, the TEST-NETs, 198.18/15 (benchmarking), multicast and 240/4 so clients really only reach the public internet, and document the full list in the README. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015eHMkP8gw2XMC4ikGMNAw8
Add stop-dns-rebind/rebind-localhost-ok as defense-in-depth against upstream answers pointing at private IPs, and clarify the upstream resolver comment (DHCP-provided resolv.conf is used in addition; offer a commented-out no-resolv for fixed-servers-only setups). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015eHMkP8gw2XMC4ikGMNAw8
Only conf.all.* was set for redirects, source routing and IPv6 forwarding, so interfaces appearing later would inherit kernel defaults. Set the default.* keys as well and offer commented-out disable_ipv6 switches for fully IPv6-free setups. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015eHMkP8gw2XMC4ikGMNAw8
The IPv4 section flushed nat/mangle but the IPv6 section only flushed filter, leaving stale rules behind on re-runs. Guard with || true since the IPv6 nat table does not exist on all kernels. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015eHMkP8gw2XMC4ikGMNAw8
Clients now get an immediate icmp-net-prohibited error instead of connection timeouts when hitting a blocked range. Stealth towards the own LAN is not a goal; external traffic still hits the DROP policy. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015eHMkP8gw2XMC4ikGMNAw8
Avoids spurious failures when another process holds the xtables lock while the ruleset is being applied. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015eHMkP8gw2XMC4ikGMNAw8
The unanchored patterns for address/netmask would also match prefixes of longer values (e.g. 10.0.99.1 inside 10.0.99.100) if the template ever grows. Match the whole address/netmask line instead. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015eHMkP8gw2XMC4ikGMNAw8
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015eHMkP8gw2XMC4ikGMNAw8
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015eHMkP8gw2XMC4ikGMNAw8
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015eHMkP8gw2XMC4ikGMNAw8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
'rc-update add' exits non-zero when the service is already installed in
the runlevel, which killed the script (set -e) on a second run. Check
the OpenRC runlevel symlink first via a small enable_service helper.
Co-Authored-By: Claude Fable 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_015eHMkP8gw2XMC4ikGMNAw8