Fix nftables Salt state for oneshot service type #7

New issue

Closed

opened 2026-03-01 02:29:57 +00:00 by forgejo_admin · 0 comments

forgejo_admin commented

2026-03-01 02:29:57 +00:00

Owner

Plan

plan-2026-02-26-salt-host-management — Phase 3 bug fix

Repo

pal-e-platform — Forgejo (private)

User Story

As a platform operator
I need the firewall Salt state to run without false failures
So that highstate output is trustworthy

Acceptance Criteria

When I run salt-call state.apply firewall
Then all states succeed (0 failures)
And nftables rules are loaded
And the service is enabled for boot

Additional Information

nftables is Type=oneshot — it loads rules and exits. service.running reports false failure because the service is "dead" after loading. Fix: use service.enabled + cmd.wait to reload on config change.

See bug-nftables-service-running-oneshot in pal-e-docs.

Checklist

PR opened
0 failures on salt-call state.apply firewall

bug-nftables-service-running-oneshot in pal-e-docs
PR #6 introduced this

### Plan `plan-2026-02-26-salt-host-management` — Phase 3 bug fix ### Repo `pal-e-platform` — Forgejo (private) ### User Story As a platform operator I need the firewall Salt state to run without false failures So that highstate output is trustworthy ### Acceptance Criteria When I run `salt-call state.apply firewall` Then all states succeed (0 failures) And nftables rules are loaded And the service is enabled for boot ### Additional Information nftables is `Type=oneshot` — it loads rules and exits. `service.running` reports false failure because the service is "dead" after loading. Fix: use `service.enabled` + `cmd.wait` to reload on config change. See `bug-nftables-service-running-oneshot` in pal-e-docs. ### Checklist - [ ] PR opened - [ ] 0 failures on `salt-call state.apply firewall` ### Related - `bug-nftables-service-running-oneshot` in pal-e-docs - PR #6 introduced this