setup ufw

make/apps/myos/def.setup.mk

@@ -5,6 +5,8 @@ SETUP_NFSD                      ?= false
 SETUP_NFSD_OSX_CONFIG           ?= nfs.server.bonjour=0 nfs.server.mount.regular_files=1 nfs.server.mount.require_resv_port=0 nfs.server.nfsd_threads=16 nfs.server.async=1
 SETUP_SYSCTL                    ?= false
 SETUP_SYSCTL_CONFIG             ?= vm.max_map_count=262144 vm.overcommit_memory=1 fs.file-max=8388608 net.core.rmem_max=2500000
+SETUP_UFW                       ?= false
+SETUP_UFW_REPOSITORY            ?= https://github.com/chaifeng/ufw-docker
 
 define setup-nfsd-osx
 	$(call INFO,setup-nfsd-osx,$(1)$(comma) $(2)$(comma) $(3))

make/apps/myos/def.ufw.mk

@@ -0,0 +1,14 @@
+CMDARGS                         += ufw ufw-docker
+
+ifeq ($(SETUP_UFW),true)
+define ufw
+	$(call INFO,ufw,$(1)$(comma))
+	$(call app-bootstrap,ufw-docker)
+	$(call app-exec,,ufw $(1))
+endef
+define ufw-docker
+	$(call INFO,ufw-docker,$(1)$(comma))
+	$(call app-bootstrap,ufw-docker)
+	$(call app-exec,,ufw-docker $(1))
+endef
+endif

make/apps/myos/setup.mk

@@ -1,6 +1,13 @@
 ##
 # SETUP
 
+# target setup-binfmt: Install binfmt abstraction layer
+.PHONY: setup-binfmt
+setup-binfmt:
+ifeq ($(SETUP_BINFMT),true)
+	$(call docker-run,--install $(SETUP_BINFMT_ARCH),--privileged tonistiigi/binfmt)
+endif
+
 # target setup-docker-group: Call ansible to add user in docker group if needed
 .PHONY: setup-docker-group
 setup-docker-group:
@@ -30,9 +37,14 @@ ifeq ($(SETUP_SYSCTL),true)
 	$(RUN) $(SUDO) sysctl -q -w $(SETUP_SYSCTL_CONFIG)
 endif
 
-# target setup-binfmt: Install binfmt abstraction layer
-.PHONY: setup-binfmt
-setup-binfmt:
-ifeq ($(SETUP_BINFMT),true)
-	$(call docker-run,--install $(SETUP_BINFMT_ARCH),--privileged tonistiigi/binfmt)
+# target setup-ufw: Install ufw-docker
+.PHONY: setup-ufw
+setup-ufw:
+ifeq ($(SETUP_UFW),true)
+	$(call app-install,$(SETUP_UFW_REPOSITORY))
+	$(call app-bootstrap,$(lastword $(subst /, ,$(SETUP_UFW_REPOSITORY))))
+	$(call app-build)
+	$(eval DOCKER_RUN_OPTIONS := --rm --cap-add NET_ADMIN -v /etc/ufw:/etc/ufw --network host)
+	$(call app-up)
+	$(call ufw-docker,install)
 endif

make/apps/myos/ufw.mk

@@ -0,0 +1,5 @@
+ufw:
+	$(call ufw,$(ARGS))
+
+ufw-docker:
+	$(call ufw-docker,$(ARGS))