Add ability to include completely raw files

[hashworks]

I have a list of files I need to include without any header or footer, which currently isn't possible. According to the README one should use nftables::config for that which Manages a raw file in /etc/nftables/puppet/${name}.nft, but that always surrounds the provided source or content with stuff.

Currently, I have to create the files manually, which isn't clean at all:

  file { '/etc/nftables/puppet/custom-include-geoipsets.nft':
    ensure  => 'present',
    mode    => '0640',
    content => @(EOT),
    # THIS FILE IS MANAGED BY PUPPET

    include "/var/local/geoipsets/dbip/nftset/ipv4/*.ipv4"
    include "/var/local/geoipsets/dbip/nftset/ipv6/*.ipv6"
    |EOT
  }

  file { '/etc/nftables/puppet-preflight/custom-include-geoipsets.nft':
    ensure => 'link',
    target => '/etc/nftables/puppet/custom-include-geoipsets.nft',
  }

Am I missing something here?

There should be an ability to A) provide a list of external *.nft files to include or B) a flag for nfttables::config to use the content as-is.

[traylenator]

Do you have the nftables::config resource you tried.

I don't use this but I would have thought it was.

nftables::config{'inet-filter':
    content => @(EOT),
    # THIS FILE IS MANAGED BY PUPPET

    include "/var/local/geoipsets/dbip/nftset/ipv4/*.ipv4"
    include "/var/local/geoipsets/dbip/nftset/ipv6/*.ipv6"
    |EOT,
}

presumably those dbip files are generated from something else and the sets in there will be added to inet-filter table.

[traylenator]

Wrong:

nftables::config{'geoip-sets':
    content => @(EOT),
    # THIS FILE IS MANAGED BY PUPPET

    include "/var/local/geoipsets/dbip/nftset/ipv4/*.ipv4"
    include "/var/local/geoipsets/dbip/nftset/ipv6/*.ipv6"
    |EOT,
}

Though I confess I am bit confused why the title has to xyz-abc

[hashworks]

This won't work, since it will always surround it with a table:

table geoip sets {
# THIS FILE IS MANAGED BY PUPPET

include "/var/local/geoipsets/dbip/nftset/ipv4/*.ipv4"
include "/var/local/geoipsets/dbip/nftset/ipv6/*.ipv6"
}

[traylenator]

So we need a new type nftables::file that does the the whole pre-flight thing.