Полный продовый фикс fix22: DNS preflight, inet firewall, idempotent bootstrap, auth-semantics и redact-config

package/config/hy2xs.env

@@ -4,7 +4,7 @@ HY2XS_DOMAIN=uk.api.withen.pro
 HY2XS_PUBLIC_HOST=uk.api.withen.pro
 HY2XS_PUBLIC_PORT=443
 HY2XS_SSH_PORT=22
-HY2XS_FIREWALL_MODE=managed
+HY2XS_FIREWALL_MODE=takeover
 HY2XS_FIREWALL_STAGED_APPLY=true
 HY2XS_UI_BIND_HOST=127.0.0.1
 HY2XS_UI_PUBLIC_ACCESS=false
@@ -12,7 +12,7 @@ HY2XS_UI_PORT=8080
 HY2XS_ADMIN_USER=hy2xsadmin
 HY2XS_ADMIN_INITIAL_PASSWORD=__GENERATE__
 HY2XS_ADMIN_CON_PASS=__GENERATE__
-HY2XS_FORCE_PASSWORD_CHANGE=false
+HY2XS_FORCE_PASSWORD_CHANGE=true
 HY2XS_ALLOW_SELF_SIGNED_DEV=false
 HY2XS_TLS_MODE=acme
 HY2XS_ACME_TYPE=http

package/templates/nftables/hy2xs.nft.tpl

@@ -1,12 +1,12 @@
-table ip hy2xs {
+table inet hy2xs {
   chain input {
     type filter hook input priority 0; policy drop;
 
     iif lo accept
     ct state established,related accept
-    tcp dport {{SSH_PORT}} accept
+    meta nfproto ipv4 tcp dport {{SSH_PORT}} accept
     {{ACME_RULE}}
-    udp dport {{HYSTERIA_PORT}} accept
-    icmp type echo-request accept
+    meta nfproto ipv4 udp dport {{HYSTERIA_PORT}} accept
+    meta nfproto ipv4 icmp type echo-request accept
   }
 }