firewall: update zones with interface names as they appear

modules/firewall/service.nix

@@ -3,11 +3,17 @@
 , lib
 , firewallgen
 , nftables
+, writeFennel
+, anoia
+, lualinux
+, linotify
 }:
 { rules, extraRules, zones }:
 let
-  inherit (liminix.services) longrun ; # oneshot;
-  inherit (lib.attrsets) mapAttrs' nameValuePair;
+  inherit (liminix.services) longrun;
+  inherit (lib.attrsets) mapAttrs' nameValuePair mapAttrsToList;
+  inherit (lib.strings) concatStringsSep;
+  inherit (lib.lists) flatten;
   mkSet = family : name :
     nameValuePair
       "${name}-set-${family}"
@@ -20,12 +26,17 @@ let
          (mapAttrs' (n : _ : mkSet "ip6" n) zones);
   allRules = lib.recursiveUpdate extraRules (lib.recursiveUpdate (builtins.trace sets sets) rules);
   script = firewallgen "firewall1.nft" allRules;
-
+  ifwatch = writeFennel "ifwatch" {
+    packages = [anoia lualinux linotify];
+    mainFunction = "run";
+  } ./ifwatch.fnl ;
+  watchArg = z : intfs : map (i: "${z}:${i}/.outputs") intfs;
 in longrun {
   name = "firewall";
   run = ''
     ${script}
-    while : ; do sleep 86400 ; done
+    PATH=${nftables}/bin:$PATH
+    ${ifwatch} ${concatStringsSep " " (flatten (mapAttrsToList watchArg zones))}
   '';
   finish = "${nftables}/bin/nft flush ruleset";
 }