feat: bootstrap awg2 harness rust workspace and docs

traffic_core/src/firewall.rs

@@ -0,0 +1,29 @@
+use crate::{config::Config, docker};
+
+pub fn apply_firewall(cfg: &Config) -> anyhow::Result<()> {
+    let target = docker::discover_target(cfg)?;
+
+    if !cfg.anti_torrent.enabled {
+        let _ = docker::run_capture(&[
+            "docker",
+            "exec",
+            &target.container_name,
+            "sh",
+            "-c",
+            "nft delete table inet awg2_harness 2>/dev/null || true",
+        ])?;
+        return Ok(());
+    }
+
+    let rule = format!(
+        "nft 'add table inet awg2_harness' 2>/dev/null || true; \
+         nft 'add chain inet awg2_harness forward_antitorrent {{ type filter hook forward priority filter; policy accept; }}' 2>/dev/null || true; \
+         nft 'flush chain inet awg2_harness forward_antitorrent'; \
+         nft 'add rule inet awg2_harness forward_antitorrent ip saddr {cidr} ct state new meter awg2_peer_connlimit_v4 {{ ip saddr ct count over {max} }} counter name antitorrent_dropped_v4 drop'",
+        cidr = cfg.anti_torrent.peer_ipv4_cidr,
+        max = cfg.anti_torrent.max_connections_per_peer
+    );
+    let _ = docker::run_capture(&["docker", "exec", &target.container_name, "sh", "-c", &rule])?;
+    Ok(())
+}
+