mirror of
https://github.com/kiddin9/op-packages.git
synced 2026-11-13 20:08:05 +08:00
🎨 Sync 2026-11-13 17:35:38
This commit is contained in:
github-actions[bot] committed
1 parent
4dc21dd663
commit
342030204e
28 files changed
+398
-162
No files matched your search
@@ -0,0 +1,74 @@
|
||||
#
|
||||
# Copyright (C) 2026 Quickstart NetPolicy Contributors
|
||||
#
|
||||
# This is free software, licensed under the GNU General Public License v3.
|
||||
#
|
||||
|
||||
include $(TOPDIR)/rules.mk
|
||||
|
||||
PKG_NAME:=quickstart-netpolicy
|
||||
PKG_VERSION:=fastnet-runtime-v0.8.9
|
||||
PKG_RELEASE:=1
|
||||
NETPOLICY_TARGET_x86_64:=x86_64-unknown-linux-musl
|
||||
NETPOLICY_TARGET_aarch64:=aarch64-unknown-linux-musl
|
||||
NETPOLICY_TARGET:=$(NETPOLICY_TARGET_$(ARCH))
|
||||
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(NETPOLICY_TARGET).tar.gz
|
||||
PKG_SOURCE_URL:=https://github.com/istoreos/istoreos-app-hub/releases/download/quickstart-runtime-v0.17.1-rc20261028/
|
||||
PKG_HASH_x86_64:=39861c6d508a900d691315b6443f274ea1e283bc3f8c9f9fa91b4e992814a372
|
||||
PKG_HASH_aarch64:=ef2dd2c67ce02b945e89c9fbff66650586fb1c1410717b9306e583c4ad53e480
|
||||
PKG_HASH:=skip
|
||||
PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
|
||||
|
||||
ifeq ($(CONFIG_USE_APK),y)
|
||||
PKG_VERSION:=fastnet-runtime-v0.8.9
|
||||
endif
|
||||
|
||||
PKG_BUILD_PARALLEL:=1
|
||||
PKG_USE_MIPS16:=0
|
||||
|
||||
include $(INCLUDE_DIR)/package.mk
|
||||
|
||||
# The packaged ELF must match binarySha256 in the runtime manifest.
|
||||
RSTRIP:=:
|
||||
|
||||
define Package/$(PKG_NAME)
|
||||
SECTION:=net
|
||||
CATEGORY:=Network
|
||||
SUBMENU:=Web Servers/Proxies
|
||||
TITLE:=Quickstart native network policy engine
|
||||
URL:=https://github.com/istoreos/quickstart-netpolicy
|
||||
DEPENDS:=@(x86_64||aarch64) +ca-bundle
|
||||
endef
|
||||
|
||||
define Package/$(PKG_NAME)/description
|
||||
Independent eBPF network-policy engine for Quickstart device rate limits.
|
||||
It uses its own binary, port, data files and kernel maps and does not replace Bandix.
|
||||
endef
|
||||
|
||||
define Package/$(PKG_NAME)/conffiles
|
||||
/etc/config/quickstart-netpolicy
|
||||
endef
|
||||
|
||||
define Build/Prepare
|
||||
rm -rf $(PKG_BUILD_DIR)
|
||||
$(INSTALL_DIR) $(PKG_BUILD_DIR)
|
||||
gzip -dc $(DL_DIR)/$(PKG_SOURCE) | tar -C $(PKG_BUILD_DIR) -xf -
|
||||
endef
|
||||
|
||||
define Build/Configure
|
||||
endef
|
||||
|
||||
define Build/Compile
|
||||
endef
|
||||
|
||||
define Package/$(PKG_NAME)/install
|
||||
$(INSTALL_DIR) $(1)/usr/bin $(1)/etc/init.d $(1)/etc/config $(1)/usr/share/quickstart-netpolicy
|
||||
$(INSTALL_BIN) $(PKG_BUILD_DIR)/payload/quickstart-netpolicy $(1)/usr/bin/quickstart-netpolicy
|
||||
$(INSTALL_BIN) ./files/quickstart-netpolicy.init $(1)/etc/init.d/quickstart-netpolicy
|
||||
$(INSTALL_CONF) ./files/quickstart-netpolicy.config $(1)/etc/config/quickstart-netpolicy
|
||||
$(INSTALL_DATA) $(PKG_BUILD_DIR)/manifest.json $(1)/usr/share/quickstart-netpolicy/manifest.json
|
||||
$(INSTALL_DATA) $(PKG_BUILD_DIR)/payload/LICENSE $(1)/usr/share/quickstart-netpolicy/LICENSE
|
||||
$(INSTALL_DATA) $(PKG_BUILD_DIR)/payload/NOTICE $(1)/usr/share/quickstart-netpolicy/NOTICE
|
||||
endef
|
||||
|
||||
$(eval $(call BuildPackage,$(PKG_NAME)))
|
||||
@@ -0,0 +1,18 @@
|
||||
# Legacy main keeps its original endpoint and data directory.
|
||||
config quickstart-netpolicy 'main'
|
||||
option network 'lan'
|
||||
option enabled '0'
|
||||
option interface 'br-lan'
|
||||
option port '8765'
|
||||
option data_dir '/usr/share/quickstart-netpolicy'
|
||||
option log_level 'info'
|
||||
option traffic_history '0'
|
||||
option dns_monitoring '0'
|
||||
|
||||
# Additional networks are opt-in and require explicit stable resources:
|
||||
# config quickstart-netpolicy 'office'
|
||||
# option enabled '0'
|
||||
# option network 'office'
|
||||
# option interface 'br-office'
|
||||
# option port '8766'
|
||||
# option data_dir '/usr/share/quickstart-netpolicy/networks/office'
|
||||
+119
@@ -0,0 +1,119 @@
|
||||
#!/bin/sh /etc/rc.common
|
||||
# quickstart-scope-context: 1
|
||||
|
||||
START=91
|
||||
STOP=15
|
||||
USE_PROCD=1
|
||||
PROG=/usr/bin/quickstart-netpolicy
|
||||
|
||||
service_triggers() {
|
||||
procd_add_reload_trigger quickstart-netpolicy
|
||||
config_load quickstart-netpolicy
|
||||
config_foreach add_network_trigger quickstart-netpolicy
|
||||
}
|
||||
|
||||
add_network_trigger() {
|
||||
local network enabled
|
||||
config_get_bool enabled "$1" enabled 0
|
||||
[ "$enabled" -eq 1 ] || return 0
|
||||
config_get network "$1" network
|
||||
[ "$1" != main ] || network="${network:-lan}"
|
||||
[ -z "$network" ] || procd_add_reload_interface_trigger "$network"
|
||||
}
|
||||
|
||||
instance_error() {
|
||||
logger -t quickstart-netpolicy "instance $1: $2"
|
||||
}
|
||||
|
||||
# Validate the whole enabled set before opening any instance. Duplicate resources
|
||||
# invalidate both entries; configuration order must not choose the winning LAN.
|
||||
collect_instance() {
|
||||
local section="$1" enabled network interface port data_dir log_level history dns other
|
||||
config_get_bool enabled "$section" enabled 0
|
||||
[ "$enabled" -eq 1 ] || return 0
|
||||
config_get network "$section" network
|
||||
config_get interface "$section" interface
|
||||
config_get port "$section" port
|
||||
config_get data_dir "$section" data_dir
|
||||
config_get log_level "$section" log_level info
|
||||
config_get_bool history "$section" traffic_history 0
|
||||
config_get_bool dns "$section" dns_monitoring 0
|
||||
if [ "$section" = main ]; then
|
||||
network="${network:-lan}"
|
||||
interface="${interface:-br-lan}"
|
||||
port="${port:-8765}"
|
||||
data_dir="${data_dir:-/usr/share/quickstart-netpolicy}"
|
||||
fi
|
||||
case "$section" in ''|*[!A-Za-z0-9_-]*) instance_error "$section" 'invalid instance identity'; return 0;; esac
|
||||
case "$network" in ''|*[!A-Za-z0-9_-]*) instance_error "$section" 'invalid network identity'; return 0;; esac
|
||||
case "$interface" in ''|*[!A-Za-z0-9_.-]*) instance_error "$section" 'invalid interface'; return 0;; esac
|
||||
case "$port" in ''|*[!0-9]*) instance_error "$section" 'port is required'; return 0;; esac
|
||||
port="$(expr "$port" + 0)"
|
||||
[ "$port" -gt 0 ] && [ "$port" -le 65535 ] || { instance_error "$section" 'invalid port'; return 0; }
|
||||
case "$data_dir" in /*) ;; *) instance_error "$section" 'absolute data_dir is required'; return 0;; esac
|
||||
case "$data_dir" in *'|'*|*'
|
||||
'*) instance_error "$section" 'invalid data_dir'; return 0;; esac
|
||||
case "$log_level" in trace|debug|info|warn|error) ;; *) instance_error "$section" 'invalid log level'; return 0;; esac
|
||||
local canonical
|
||||
canonical="$(readlink -f "$data_dir" 2>/dev/null)"
|
||||
[ -z "$canonical" ] || data_dir="$canonical"
|
||||
local IFS='
|
||||
'
|
||||
for other in $instance_records; do
|
||||
local old_section old_network old_interface old_port old_dir rest
|
||||
old_section="${other%%|*}"; rest="${other#*|}"
|
||||
old_network="${rest%%|*}"; rest="${rest#*|}"
|
||||
old_interface="${rest%%|*}"; rest="${rest#*|}"
|
||||
old_port="${rest%%|*}"; rest="${rest#*|}"
|
||||
old_dir="${rest%%|*}"
|
||||
if [ "$network" = "$old_network" ] || [ "$interface" = "$old_interface" ] || [ "$port" = "$old_port" ] || [ "$data_dir" = "$old_dir" ]; then
|
||||
invalid_instances="$invalid_instances $section $old_section"
|
||||
instance_error "$section" "duplicate network/interface/port/data_dir with $old_section"
|
||||
fi
|
||||
done
|
||||
instance_records="${instance_records}${instance_records:+
|
||||
}$section|$network|$interface|$port|$data_dir|$log_level|$history|$dns"
|
||||
}
|
||||
|
||||
start_instance() {
|
||||
local section="$1" network interface port data_dir log_level history dns status actual
|
||||
case " $invalid_instances " in *" $section "*) return 0;; esac
|
||||
config_get network "$section" network lan
|
||||
config_get interface "$section" interface br-lan
|
||||
config_get port "$section" port 8765
|
||||
config_get data_dir "$section" data_dir /usr/share/quickstart-netpolicy
|
||||
config_get log_level "$section" log_level info
|
||||
config_get_bool history "$section" traffic_history 0
|
||||
config_get_bool dns "$section" dns_monitoring 0
|
||||
status="$(ubus -S call "network.interface.$network" status 2>/dev/null)" || { instance_error "$section" 'network unavailable'; return 0; }
|
||||
actual="$(printf '%s' "$status" | jsonfilter -e '@.l3_device')"
|
||||
[ "$actual" = "$interface" ] || { instance_error "$section" 'interface does not match logical network'; return 0; }
|
||||
[ -d "/sys/class/net/$interface" ] || { instance_error "$section" 'interface unavailable'; return 0; }
|
||||
procd_open_instance "$section"
|
||||
procd_set_param command "$binary" --iface "$interface" --port "$port" --data-dir "$data_dir" --network-id "$network" --instance-id "$section" --log-level "$log_level" --enable-traffic
|
||||
[ "$history" -eq 1 ] && procd_append_param command --traffic-enable-storage
|
||||
[ "$dns" -eq 1 ] && procd_append_param command --enable-dns
|
||||
procd_set_param netdev "$interface"
|
||||
procd_set_param respawn 3600 5 3
|
||||
procd_set_param term_timeout 10
|
||||
procd_set_param stdout 1
|
||||
procd_set_param stderr 1
|
||||
procd_set_param limits core="0 0"
|
||||
procd_close_instance
|
||||
}
|
||||
|
||||
start_service() {
|
||||
local instance_records='' invalid_instances='' record binary="$PROG"
|
||||
[ -x "$binary" ] || { instance_error main "missing executable $binary"; return 1; }
|
||||
config_load quickstart-netpolicy
|
||||
config_foreach collect_instance quickstart-netpolicy
|
||||
local IFS='
|
||||
'
|
||||
for record in $instance_records; do start_instance "${record%%|*}"; done
|
||||
}
|
||||
|
||||
# procd compares named instance commands, so unchanged networks keep their
|
||||
# processes and TC links. Do not implement reload as stop/start.
|
||||
reload_service() {
|
||||
rc_procd start_service
|
||||
}
|
||||
Reference in new issue
Block a user