Update netbird ips in nft sets on monitor events

1 files changed, 54 insertions, 0 deletions

diff --git a/api/update-netbird-nftables.nu b/api/update-netbird-nftables.nu
new file mode 100644
index 0000000..95b9e02
--- /dev/null
+++ b/api/update-netbird-nftables.nu
@@ -0,0 +1,54 @@
+use netbird-api.nu
+
+def mangle-name [prefix: string, name: string] {
+    $prefix + ($name 
+        | str replace -ar '\s+' '_'
+        | str replace -ar  '\W' '')
+}
+
+def find-changed-sets [] {
+    let sets = $in # nft_sets
+        | rename --column { name: nft_name }
+    let peers = netbird-api peers list 
+        | insert nft_name { mangle-name 'nbp_' $in.name | str downcase }
+        | insert new_elem { [$in.ip] }
+    let groups = netbird-api groups list 
+        | where peers != null 
+        | each { update peers { select id | join $peers id } }
+        | insert nft_name { mangle-name 'nbg_' $in.name } # allow uppercase
+        | insert new_elem { $in.peers.ip }
+
+    let set_changes = [$peers, $groups] | flatten 
+        | join $sets nft_name
+        | where { $in.new_elem != $in.elem }
+    return $set_changes
+}
+
+def generate-nft-commands [] {
+# nft add talbe inet <name>     # ignore if table already exists
+# nft destroy table inet <name> # ignore if table already removed
+    let set_changes = $in
+    $set_changes | each {|s|
+        let path = [$s.family $s.table $s.nft_name] | str join ' '
+        [
+            $"flush set ($path)",
+            $"add element ($path) { ($s.new_elem | str join ', ') }"
+        ]
+    } | flatten
+}
+
+def main [--test, --apply] {
+    let commands = if $test {
+        open --raw test-data/nft-sets.json
+    } else {
+        ^nft --json list sets
+    }   | from json | get nftables | skip 1 | get set 
+        | find-changed-sets 
+        | generate-nft-commands
+        | str join "\n"
+    if $apply {
+        $commands | ^nft -f -
+    } else {
+        $commands
+    }
+}