[21.05] Test for firewall differences between specialisations in router role

[sysvinit]

This change adds a test for the router role which checks if the firewall service unit is the same between specialisations. Differences in the unit file will cause a reload when switching specialisations, which causes interruptions to connectivity, as established in #1003.

PL-132482

@flyingcircusio/release-managers

Release process

Impact: internal.

Changelog: none.

PR release workflow (internal)

• PR has internal ticket
• internal issue ID (PL-…) part of branch name
• internal issue ID mentioned in PR description text
• ticket is on Platform agile board
• ticket state set to Pull request ready
• if ticket is more urgent than within the next few days, directly contact a member of the Platform team

Design notes

• Provide a feature toggle if the change might need to be adjusted/reverted quickly depending on context. Consider whether the default should be on or off. Example: rate limiting.
• All customer-facing features and (NixOS) options need to be discoverable from documentation. Add or update relevant documentation such that hosted and guided customers can understand it as well.

Security implications

• Security requirements defined? (WHERE)
  • Regression test for previously fixed issue in the router role.
• Security requirements tested? (EVIDENCE)
  • The test passes on the current state of the dev branch, and partially reverting the fix for the TFTP firewall rules causes the test to fail.