commit c80927013a38bb0c50947e14cf09b79fe8476b46
Author: tr <tr@immerda.ch>
Date:   Sun Aug 30 12:17:53 2020 +0200

    Split init class

diff --git a/manifests/inet_filter.pp b/manifests/inet_filter.pp
new file mode 100644
index 0000000..b57e417
--- /dev/null
+++ b/manifests/inet_filter.pp
@@ -0,0 +1,84 @@
+# manage basic chains in table inet filter
+class nftables::inet_filter inherits nftables {
+
+  nftables::config{
+    'inet-filter':
+      source => 'puppet:///modules/nftables/config/puppet-filter.nft';
+  }
+
+  nftables::chain{
+    [
+      'INPUT',
+      'OUTPUT',
+      'FORWARD',
+    ]:;
+  }
+
+  nftables::chain{
+    'default_in':
+      inject => '10-INPUT';
+    'default_out':
+      inject => '10-OUTPUT';
+    'default_fwd':
+      inject => '10-FORWARD';
+  }
+
+  # inet-filter-chain-INPUT
+  nftables::rule{
+    'INPUT-type':
+      order   => '01',
+      content => 'type filter hook input priority 0';
+    'INPUT-policy':
+      order   => '02',
+      content => 'policy drop';
+    'INPUT-lo':
+      order   => '03',
+      content => 'iifname lo accept';
+    'INPUT-jump_global':
+      order   => '04',
+      content => 'jump global';
+    'INPUT-log_rejected':
+      order   => '98',
+      content => 'log prefix "[nftables] INPUT Rejected: " flags all counter reject with icmpx type port-unreachable';
+  }
+
+  # inet-filter-chain-OUTPUT
+  nftables::rule{
+    'OUTPUT-type':
+      order   => '01',
+      content => 'type filter hook output priority 0';
+    'OUTPUT-policy':
+      order   => '02',
+      content => 'policy drop';
+    'OUTPUT-lo':
+      order   => '03',
+      content => 'oifname lo accept';
+    'OUTPUT-jump_global':
+      order   => '04',
+      content => 'jump global';
+    'OUTPUT-log_rejected':
+      order   => '98',
+      content => 'log prefix "[nftables] OUTPUT Rejected: " flags all counter reject with icmpx type port-unreachable';
+  }
+
+  # inet-filter-chain-FORWARD
+  nftables::rule{
+    'FORWARD-type':
+      order   => '01',
+      content => 'type filter hook forward priority 0';
+    'FORWARD-policy':
+      order   => '02',
+      content => 'policy drop';
+    'FORWARD-jump_global':
+      order   => '03',
+      content => 'jump global';
+    'FORWARD-log_rejected':
+      order   => '98',
+      content => 'log prefix "[nftables] FORWARD Rejected: " flags all counter reject with icmpx type port-unreachable';
+  }
+
+  # basic ingoing rules
+  if $nftables::in_ssh {
+    include nftables::rules::ssh
+  }
+}
diff --git a/manifests/init.pp b/manifests/init.pp
index 746e0ba..bd9368a 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -33,132 +33,6 @@ class nftables (
     enable => true,
   }
 
-  nftables::config{
-    'inet-filter':
-      source => 'puppet:///modules/nftables/config/puppet-filter.nft';
-    'ip-nat':
-      source => 'puppet:///modules/nftables/config/puppet-ip-nat.nft';
-  }
-
-  nftables::chain{
-    [
-      'INPUT',
-      'OUTPUT',
-      'FORWARD',
-    ]:;
-  }
-
-  nftables::chain{
-    [
-      'PREROUTING',
-      'POSTROUTING',
-    ]:
-      table => 'ip-nat';
-  }
-
-  nftables::chain{
-    'default_in':
-      inject => '10-INPUT';
-    'default_out':
-      inject => '10-OUTPUT';
-    'default_fwd':
-      inject => '10-FORWARD';
-  }
-
-  # inet-filter-chain-INPUT
-  nftables::rule{
-    'INPUT-type':
-      order   => '01',
-      content => 'type filter hook input priority 0';
-    'INPUT-policy':
-      order   => '02',
-      content => 'policy drop';
-    'INPUT-lo':
-      order   => '03',
-      content => 'iifname lo accept';
-    'INPUT-jump_global':
-      order   => '04',
-      content => 'jump global';
-    'INPUT-log_rejected':
-      order   => '98',
-      content => 'log prefix "[nftables] INPUT Rejected: " flags all counter reject with icmpx type port-unreachable';
-  }
-
-  # inet-filter-chain-OUTPUT
-  nftables::rule{
-    'OUTPUT-type':
-      order   => '01',
-      content => 'type filter hook output priority 0';
-    'OUTPUT-policy':
-      order   => '02',
-      content => 'policy drop';
-    'OUTPUT-lo':
-      order   => '03',
-      content => 'oifname lo accept';
-    'OUTPUT-jump_global':
-      order   => '04',
-      content => 'jump global';
-    'OUTPUT-log_rejected':
-      order   => '98',
-      content => 'log prefix "[nftables] OUTPUT Rejected: " flags all counter reject with icmpx type port-unreachable';
-  }
-
-  # inet-filter-chain-FORWARD
-  nftables::rule{
-    'FORWARD-type':
-      order   => '01',
-      content => 'type filter hook forward priority 0';
-    'FORWARD-policy':
-      order   => '02',
-      content => 'policy drop';
-    'FORWARD-jump_global':
-      order   => '03',
-      content => 'jump global';
-    'FORWARD-log_rejected':
-      order   => '98',
-      content => 'log prefix "[nftables] FORWARD Rejected: " flags all counter reject with icmpx type port-unreachable';
-  }
-
-  # ip-nat-chain-PREROUTING
-  nftables::rule{
-    default:
-      table   => 'ip-nat';
-    'PREROUTING-type':
-      order   => '01',
-      content => 'type nat hook prerouting priority -100';
-    'PREROUTING-policy':
-      order   => '02',
-      content => 'policy accept';
-  }
-
-  # ip-nat-chain-POSTROUTING
-  nftables::rule{
-    default:
-      table   => 'ip-nat';
-    'POSTROUTING-type':
-      order   => '01',
-      content => 'type nat hook postrouting priority 100';
-    'POSTROUTING-policy':
-      order   => '02',
-      content => 'policy accept';
-  }
-
-  # basic ingoing rules
-  if $in_ssh {
-    include nftables::rules::ssh
-  }
-
-  # basic outgoing rules
-  if $out_ntp {
-    include nftables::rules::out::chrony
-  }
-  if $out_dns {
-    include nftables::rules::out::dns
-  }
-  if $out_http {
-    include nftables::rules::out::http
-  }
-  if $out_https {
-    include nftables::rules::out::https
-  }
+  include nftables::inet_filter
+  include nftables::ip_nat
 }
diff --git a/manifests/ip_nat.pp b/manifests/ip_nat.pp
new file mode 100644
index 0000000..6f89913
--- /dev/null
+++ b/manifests/ip_nat.pp
@@ -0,0 +1,54 @@
+# manage basic chains in table ip nat
+class nftables::ip_nat inherits nftables {
+
+  nftables::config{
+    'ip-nat':
+      source => 'puppet:///modules/nftables/config/puppet-ip-nat.nft';
+  }
+
+  nftables::chain{
+    [
+      'PREROUTING',
+      'POSTROUTING',
+    ]:
+      table => 'ip-nat';
+  }
+
+  # ip-nat-chain-PREROUTING
+  nftables::rule{
+    default:
+      table   => 'ip-nat';
+    'PREROUTING-type':
+      order   => '01',
+      content => 'type nat hook prerouting priority -100';
+    'PREROUTING-policy':
+      order   => '02',
+      content => 'policy accept';
+  }
+
+  # ip-nat-chain-POSTROUTING
+  nftables::rule{
+    default:
+      table   => 'ip-nat';
+    'POSTROUTING-type':
+      order   => '01',
+      content => 'type nat hook postrouting priority 100';
+    'POSTROUTING-policy':
+      order   => '02',
+      content => 'policy accept';
+  }
+
+  # basic outgoing rules
+  if $nftables::out_ntp {
+    include nftables::rules::out::chrony
+  }
+  if $nftables::out_dns {
+    include nftables::rules::out::dns
+  }
+  if $nftables::out_http {
+    include nftables::rules::out::http
+  }
+  if $nftables::out_https {
+    include nftables::rules::out::https
+  }
+}
