From 009afb2fff0ed63d89b74ace01d0c396d18209a2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nicolas=20Mass=C3=A9?= <nmasse@redhat.com>
Date: Thu, 18 Sep 2025 09:45:37 -0400
Subject: [PATCH] wip

---
 bootc/scenario3a/Containerfile                |  1 -
 bootc/scenario3a/root/etc/libvirt/hooks/qemu  | 49 +++++++++++++++++++
 .../libvirt/hooks/qemu.d/nextcloud/iptables   |  2 +
 .../scenario3a/root/etc/nftables/libvirt.nft  | 32 ------------
 .../root/etc/sysconfig/nftables.conf          |  1 -
 5 files changed, 51 insertions(+), 34 deletions(-)
 create mode 100755 bootc/scenario3a/root/etc/libvirt/hooks/qemu
 create mode 100644 bootc/scenario3a/root/etc/libvirt/hooks/qemu.d/nextcloud/iptables
 delete mode 100755 bootc/scenario3a/root/etc/nftables/libvirt.nft
 delete mode 100644 bootc/scenario3a/root/etc/sysconfig/nftables.conf

diff --git a/bootc/scenario3a/Containerfile b/bootc/scenario3a/Containerfile
index ceaf4f8..c6d3b77 100644
--- a/bootc/scenario3a/Containerfile
+++ b/bootc/scenario3a/Containerfile
@@ -5,5 +5,4 @@ ADD --chown=root:root root /
 RUN <<EOF
 set -Eeuo pipefail
 systemctl enable bootstrap-vm@nextcloud.service
-systemctl enable nftables.service
 EOF
diff --git a/bootc/scenario3a/root/etc/libvirt/hooks/qemu b/bootc/scenario3a/root/etc/libvirt/hooks/qemu
new file mode 100755
index 0000000..37685cb
--- /dev/null
+++ b/bootc/scenario3a/root/etc/libvirt/hooks/qemu
@@ -0,0 +1,49 @@
+#!/bin/bash
+
+set -Eeuo pipefail
+
+# This script is called by libvirt when a VM is started or stopped.
+# It is used to set up and tear down networking for the VM.
+# The script takes two arguments: the VM name and the action (start or stop).
+VM_NAME="$1"
+ACTION="$2"
+
+# Check if the networking configuration file exists for the VM
+if [ ! -f "/etc/libvirt/hooks/qemu.d/${VM_NAME}/iptables" ]; then
+    echo "No networking configuration found for VM '$VM_NAME'. Skipping."
+    exit 0
+fi
+
+if [ "$ACTION" = "started" ] || [ "$ACTION" = "reconnect" ]; then
+    echo "Setting up networking for VM '$VM_NAME'..."
+
+    # Set up iptables rules
+    while read -r rule; do
+        if [ -z "$rule" ]; then
+            continue
+        fi
+        iptables $rule
+    done < "/etc/libvirt/hooks/qemu.d/${VM_NAME}/iptables"
+
+    echo "Networking setup complete for VM '$VM_NAME'."
+elif [ "$ACTION" = "stopped" ] || [ "$ACTION" = "disconnect" ]; then
+    echo "Tearing down networking for VM '$VM_NAME'..."
+
+    # Tear down iptables rules
+    while read -r rule; do
+        if [ -z "$rule" ]; then
+            continue
+        fi
+        # Replace '-A'/'-I' with '-D' to delete the rule
+        rule="${rule/-A/-D}"
+        rule="${rule/-I/-D}"
+        iptables $rule || echo "Warning: Failed to delete iptables rule: iptables $rule"
+    done < "/etc/libvirt/hooks/qemu.d/${VM_NAME}/iptables"
+
+    echo "Networking teardown complete for VM '$VM_NAME'."
+else
+    echo "Unknown action '$ACTION'. Supported actions are 'started', 'stopped', 'reconnect', and 'disconnect'."
+    echo "Skipping."
+fi
+
+exit 0
diff --git a/bootc/scenario3a/root/etc/libvirt/hooks/qemu.d/nextcloud/iptables b/bootc/scenario3a/root/etc/libvirt/hooks/qemu.d/nextcloud/iptables
new file mode 100644
index 0000000..afcf7b4
--- /dev/null
+++ b/bootc/scenario3a/root/etc/libvirt/hooks/qemu.d/nextcloud/iptables
@@ -0,0 +1,2 @@
+-t nat -A PREROUTING -p tcp --dport 80 -d 192.168.2.75 -j DNAT --to-destination 192.168.122.2:80
+-t filter -I LIBVIRT_FWI -d 192.168.122.2 -p tcp --dport 80 -m conntrack --ctstate NEW -j ACCEPT
diff --git a/bootc/scenario3a/root/etc/nftables/libvirt.nft b/bootc/scenario3a/root/etc/nftables/libvirt.nft
deleted file mode 100755
index 8a035a5..0000000
--- a/bootc/scenario3a/root/etc/nftables/libvirt.nft
+++ /dev/null
@@ -1,32 +0,0 @@
-#!/usr/sbin/nft -f
-
-destroy table ip libvirt-nat
-
-##
-## TODO
-##
-
-table ip libvirt-nat {
-
-    chain FORWARD {
-        type filter hook forward priority filter - 10
-        policy accept
-        
-        # Accept packets related to existing connections
-        ct state invalid counter drop
-        ct state { established, related } counter accept
-
-        oifname "virbr0" ip daddr 192.168.122.2/24 tcp dport { 80, 9090 } ct state { new } counter accept
-    }
-
-    chain Pre-Routing {
-        type nat hook prerouting priority dstnat - 10
-        policy accept
-
-        # Redirect HTTP connections to the Nextcloud VM
-        iifname != "virbr0" ip daddr 192.168.2.0/24 tcp dport 80 counter dnat to 192.168.122.2
-
-        # Redirect Cockpit connections to the Nextcloud VM
-        iifname != "virbr0" ip daddr 192.168.2.0/24 tcp dport 9091 counter dnat to 192.168.122.2:9090
-    }
-}
diff --git a/bootc/scenario3a/root/etc/sysconfig/nftables.conf b/bootc/scenario3a/root/etc/sysconfig/nftables.conf
deleted file mode 100644
index d0e254c..0000000
--- a/bootc/scenario3a/root/etc/sysconfig/nftables.conf
+++ /dev/null
@@ -1 +0,0 @@
-include "/etc/nftables/libvirt.nft"