console.git/statuspage/checks/pf.sh, branch master

Document abbreviate_rule's nat/rdr blind spot and ddclient's log gap

2026-07-01T10:11:15Z

From a fresh-agent review of AGENTS.md against two hypothetical tasks: - abbreviate_rule() in pf.sh has only ever been developed/tested against filter-rule (-sr) syntax, despite also running on -sn (nat/rdr) output. It degrades safely (unshortened passthrough) but a new nat/rdr rule shape isn't guaranteed to compress as tightly - noted both in the code comment and in AGENTS.md's compression writeup so this doesn't need rediscovering. - ddclient logging isn't enabled on the box, so "is the last DNS update actually succeeding" can't be built by tailing a log that doesn't exist - it'd need the cache file or a public-IP comparison instead. Recorded in AGENTS.md's topology section since ddclient.sh currently only checks the process is running, not update success. Co-Authored-By: Claude Sonnet 5

Distinguish pf state-tracking modes with bracketed letter tags

2026-07-01T09:22:17Z

Previously "keep state" and "modulate state" both collapsed to the same generic "[state]" tag, losing a real distinction: modulate state hardens TCP ISN generation and synproxy state (not handled at all before) proxies the handshake against spoofed SYN floods - neither is just "some tracking is happening." Now [N]/[K]/[M]/[S] map to no/keep/ modulate/synproxy state respectively, documented in a comment since the mapping isn't self-evident without pf.conf familiarity. Considered thematic unicode symbols from the font's supported blocks (Mathematical Operators, Geometric Shapes) instead, but a bracketed letter is unambiguous without a legend - a clever but obscure glyph isn't actually more compact once you factor in "what does this mean." Co-Authored-By: Claude Sonnet 5

Sort pf rules by interface, iconify from/to, drop redundant nat prefix

2026-07-01T09:01:39Z

Filter rules now sort by (interface, in-before-out) rather than pfctl's raw eval order, which just reflects pf.conf's authoring order and reads as arbitrarily interleaved (an "out" rule sandwiched between unrelated "in" rules for the same interface). Display-only reorder - pf's actual evaluation order and quick/first-match semantics on the box are untouched, only the informational listing is re-sorted. Generalized the "from X to Y" abbreviation beyond the from-any-to-any- port special case, and replaced pfctl's own "->" (nat rewrite target) with the unicode arrow for consistency with the in/out arrows already in use. Also dropped the "nat: " prefix, which was redundant with the rule text already starting with "nat". Applied the same "->" -> "→" consistency swap to jails.sh's http child-row label. Co-Authored-By: Claude Sonnet 5

Abbreviate pf rule text so rows fit the column without wrapping

2026-07-01T08:46:33Z

pfctl's verbose syntax (flags S/SA, quick, from any to any port = X, proto tcp/udp/icmp) was overflowing the .section column width and wrapping mid-rule. abbreviate_rule() in pf.sh strips the near- universal boilerplate tokens on this ruleset and swaps in/out for arrows - cuts each rule to roughly 35-45% of its original length. Deliberately not a real pf syntax parser: it's a handful of targeted sed substitutions, so a rule shape it doesn't recognize just passes through unshortened rather than mangling. Only uses the Arrows block (confirmed shipped in the scientifica font) - avoided Dingbats (checkmark/X) since that block isn't included in this font. Co-Authored-By: Claude Sonnet 5

Add pf visibility and a wg-quick watcher check, add a neutral row status

2026-07-01T07:52:22Z

checks/pf.sh reports pf enabled/disabled, state table usage (warn/down as it nears the configured limit), and the loaded filter/nat rule count, then lists each active rule as its own row for at-a-glance visibility into what's actually being enforced. Those rule rows use a new "info" status (gray square) rather than "ok" - they're not a health check on any individual rule, so a green square there would misleadingly imply otherwise. render.sh maps info -> gray; anything else still falls back to red. checks/wg-watcher.sh checks the route-monitor process wg-quick spawns to react to WAN interface/address changes - it isn't rc.d-managed, so there's no `service status` for it, hence the new proc_running helper in lib/common.sh (pgrep -f based). Co-Authored-By: Claude Sonnet 5