warden 0.3.0

warden decides what may cross, not only which port a service gets.

A firewall

$ warden firewall allow ssh --from 10.0.0.0/8
$ warden firewall apply
12 rules applied
rolling back in 60s unless you run `warden firewall confirm`

Every change undoes itself unless you confirm it. A snapshot is taken first, the rollback armed second, the change applied third — and the watchdog runs detached, so it outlives the ssh session that armed it. A rule that locks you out costs a minute, not a drive.

Four backends, picked by what the machine is: nftables and iptables on Linux, pf on macOS and the BSDs, Windows Defender Firewall through netsh. Three swap a whole ruleset in one transaction; Windows has no such thing, so that one snapshots around the change instead.

warden firewall export --for nftables prints what a machine would be told and changes nothing, on any machine.

Taking over from ufw or firewalld

warden firewall adopt reads the other firewall's rules, shows them, applies them as warden's own — and turns the other one off only once you confirm. Until then it is still enabled, so rolling back returns the machine exactly as it was. Anything that cannot be translated is named before you decide.

Rules that belong to a service

The registry and the firewall are one program, so a rule can be bound to a service rather than to a number:

$ warden firewall open shop-api      # the port the registry handed out
$ warden firewall dev-mode --for 2   # the whole pool, for the afternoon

Both close themselves — the first when the service's lease lapses, the second when its clock runs out.

The registry can never open the wrong port. A rule that comes from it may only touch a port inside the pool, may only reach networks declared in advance, and cannot outlive the lease it borrowed. 22, 3389 and 445 are outside the pool and stay unreachable. It is off until you turn it on, and warden setup is where you do.

Renamed

The project manifest is warden.project.toml, because warden.toml was also the settings file. warden apply still reads the old name and tells you what to rename it to.

Also

• warden setup has a firewall section, and says when ufw or firewalld is holding the machine.
• Six security fixes, each demonstrated and pinned with a test: rule injection through a comment or an interface, service metadata rewriting a generated proxy config, a redaction that printed the credentials it was written to hide, the signing secret shown by warden settings, a world-readable settings file, and a guessable path for the Windows firewall snapshot.
• WARDEN_RESERVED works from the environment, which it never had.

uv tool install warden-ports