pal-e-docs

Bug: nftables Salt state uses service.running for oneshot service

bug-nftables-service-running-oneshot Todo

bug resolved
Project

Bug: nftables Salt state uses service.running for oneshot service

Problem

salt-call state.apply firewall reports 1 failure:
The rules are actually loaded correctly. The failure is a false positive.

Root Cause

nftables is a Type=oneshot systemd service. It loads /etc/nftables.conf into the kernel and exits. This is by design — firewall rules live in the kernel, not in a daemon process. Salt's service.running expects the service to stay running and reports failure when it finds the service "dead" after loading.

Fix

In salt/states/firewall/init.sls: replace service.running with service.enabled (for boot persistence) and add a cmd.run or cmd.wait that executes systemctl restart nftables (or nft -f /etc/nftables.conf) when the config file changes. This way Salt enables the service for boot and reloads rules on config change without expecting a persistent daemon.

Impact

Every highstate reports 1 false failure on the firewall state. This erodes trust in highstate output — operators can't distinguish real failures from this known false positive. No actual security impact — rules are loaded correctly despite the reported failure.

Acceptance Criteria

  • [ ] salt-call state.apply firewall shows 0 failures
  • [ ] nft list ruleset shows correct rules after apply
  • [ ] systemctl is-enabled nftables returns enabled
  • [ ] Config changes trigger rule reload
  • plan-2026-02-26-salt-host-management — Phase 3
  • issue-pal-e-platform-salt-phase-3-nftables — parent issue, PR #6 introduced this