#!/usr/sbin/nft -f
# NOTE: deliberately does NOT `flush ruleset` - that wipes Docker's own
# iptables-nft managed nat/filter tables too, breaking container port
# publishing on `docker compose up` (confirmed live: this exact mistake
# broke Graylog's Docker network and had to be recovered with a full
# `docker compose down && up`). Only this table is touched, and only this
# table's own rules are flushed - safe whether or not it already exists,
# and safe regardless of nftables.service vs docker.service start order.

add table inet filter
flush table inet filter

table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;

        iif lo accept
        ct state established,related accept
        ip protocol icmp accept

        tcp dport 9000 accept   # Graylog Web UI / REST API
        udp dport 514 accept    # syslog, standard port (most network gear can't use anything else)
        udp dport 1514 accept   # syslog, network equipment that can use a custom port
        udp dport 5140 accept   # syslog, servers (RADIUS/accel-ppp)
    }

    chain forward {
        type filter hook forward priority 0; policy accept;
    }

    chain output {
        type filter hook output priority 0; policy accept;
    }
}