Add firewall migration from boot

Author: badrogger

node_cli/configs/user.py

@@ -150,10 +150,12 @@ def validate_user_config(user_config: BaseUserConfig) -> None:
     validate_env_type(env_type=user_config.env_type)
 
     if not isinstance(user_config, MirageUserConfig):
-        validate_alias_or_address(user_config.manager_contracts, ContractType.MANAGER, user_config.endpoint)
+        validate_alias_or_address(
+            user_config.manager_contracts, ContractType.MANAGER, user_config.endpoint
+        )
 
     if isinstance(user_config, (SkaleUserConfig, MirageBootUserConfig)):
-        validate_alias_or_address(user_config.ima_contracts, ContractType.IMA, endpoint)
+        validate_alias_or_address(user_config.ima_contracts, ContractType.IMA, user_config.endpoint)
 
 
 def to_lower_keys(params: Dict[str, str]) -> Dict[str, str]:

node_cli/core/mirage_node.py

@@ -61,7 +61,7 @@ def migrate_from_boot(
         sync_schains=False,
         node_type=NodeType.MIRAGE,
     )
-    migrate_ok = update_mirage_op(env_filepath, env, update_type=MirageUpdateType.INFRA_ONLY)
+    migrate_ok = update_mirage_op(env_filepath, env, update_type=MirageUpdateType.FROM_BOOT)
     alive = is_base_containers_alive(node_type=NodeType.MIRAGE)
     if not migrate_ok or not alive:
         print_node_cmd_error()

node_cli/migrations/mirage/from_boot.py

@@ -0,0 +1,34 @@
+import glob
+import logging
+import os
+from pathlib import Path
+
+from node_cli.utils.helper import run_cmd
+
+logger = logging.getLogger(__name__)
+
+NFT_CHAIN_BASE_PATH = '/etc/nft.conf.d/skale/chains'
+NFT_COMMITTEE_SCOPE_CHAIN_PATH = 'mirage-committee.conf'
+
+
+class NoLegacyNFTChainConfigError(Exception):
+    pass
+
+
+def move_chain_to_new_name() -> None:
+    after_boot_chain_path = glob.glob(os.path.join(NFT_CHAIN_BASE_PATH, '*'))[0]
+    new_path = os.path.join(NFT_CHAIN_BASE_PATH, NFT_COMMITTEE_SCOPE_CHAIN_PATH)
+    if Path(after_boot_chain_path).exists():
+        raise NoLegacyNFTChainConfigError(f'File {after_boot_chain_path} does not exists')
+    Path(after_boot_chain_path).rename(Path(new_path))
+
+
+def reload_nft():
+    run_cmd(['nft', '-f', '/etc/nftables.conf'])
+
+
+def migrate_nftables_from_boot():
+    logger.info('Starting nftables migration from boot')
+    move_chain_to_new_name()
+    logger.info('Reloading nftables rules')
+    reload_nft()

node_cli/operations/mirage.py

@@ -30,6 +30,7 @@
 from node_cli.core.host import ensure_btrfs_kernel_module_autoloaded, link_env_file, prepare_host
 from node_cli.core.nftables import configure_nftables
 from node_cli.core.nginx import generate_nginx_config
+from node_cli.migrations.mirage.from_boot import migrate_nftables_from_boot
 from node_cli.operations.base import checked_host
 from node_cli.operations.common import unpack_backup_archive
 from node_cli.operations.config_repo import (
@@ -53,13 +54,15 @@
 class MirageUpdateType(Enum):
     REGULAR = 'regular'
     INFRA_ONLY = 'infra_only'
+    FROM_BOOT = 'from_boot'
 
 
 @checked_host
 def update_mirage(env_filepath: str, env: dict, update_type: MirageUpdateType) -> bool:
     compose_rm(node_type=NodeType.MIRAGE, env=env)
-    if update_type != MirageUpdateType.INFRA_ONLY:
+    if update_type in (MirageUpdateType.INFRA_ONLY, MirageUpdateType.FROM_BOOT):
         remove_dynamic_containers()
+
     sync_skale_node()
     ensure_btrfs_kernel_module_autoloaded()
 
@@ -87,6 +90,9 @@ def update_mirage(env_filepath: str, env: dict, update_type: MirageUpdateType) -
         distro.id(),
         distro.version(),
     )
+
+    if update_type == MirageUpdateType.FROM_BOOT:
+        migrate_nftables_from_boot()
     update_images(env=env, node_type=NodeType.MIRAGE)
     compose_up(env=env, node_type=NodeType.MIRAGE)
     return True