#
# Cookbook:: irrigate-orchard_base
# Recipe:: firewall
#
# Copyright: The Orchard
#

include_recipe 'firewall'

if node['os'] == 'linux'
  # Ensure loopback traffic is configured
  firewall_rule 'allow loopback from lo' do
    interface 'lo'
    protocol :none
    command :allow
    only_if { linux? && node['firewall']['allow_loopback'] }
  end

  firewall_rule 'drop packets from 127.0.0.0/8' do
    source '127.0.0.0/8'
    protocol :none
    command :deny
    only_if { linux? && node['firewall']['allow_loopback'] }
  end

  firewall_rule 'allow output to lo' do
    dest_interface 'lo'
    direction :out
    protocol :none
    command :allow
    only_if { linux? && node['firewall']['allow_loopback'] }
  end

  # Firewall rule for SSH
  firewall_rule 'ssh' do
    port 22
    protocol :tcp
    position 10
    command :allow
  end
end