diff options
Diffstat (limited to 'fw/man')
| -rw-r--r-- | fw/man/fw | 66 |
1 files changed, 66 insertions, 0 deletions
@@ -348,6 +348,67 @@ everything else instead. .PP .B /lib/fw/fw.rc does this in the right order: private namespace, mount, drop, exec. +.SH SUPERVISION +.I Fw +posts its filesystem on +.BI /srv/ name +with +.BR -s , +forks the server, and the process you started exits - the ordinary +Plan 9 file server shape. +A supervisor must therefore watch the +.B /srv +name rather than the pid. +Under +.IR init (8) +that is +.BR ready=srv: : +.IP +.EX +svc=fw.ether0 + exec=/bin/fw + args=-s + args=fw.ether0 + args=-m + args=/mnt/fw/ether0 + args=-e + args=/net/ether0 + args=/lib/fw/host.ndb + needs=ipconfig + ready=srv:fw.ether0 + restart=always + enable=yes +.EE +.PP +The name means what it says: it appears when the server posts it and +goes when the last of +.I fw +exits. +Anything that stops one part stops all of them - a wire that fails, a +control filesystem that is unmounted, a note - so a +.B /srv +name that is present is a firewall that is filtering. +.PP +There is no foreground mode and none is needed. +What such a mode would buy is a pid to watch, and the +.B /srv +name is the better signal: it survives the process that made it and +answers the question that matters. +.PP +Restarting is not free. +.B Restart=always +will bring +.I fw +back, but taking a card is destructive and is not undone, so the card +must be configured again before the new +.I fw +can read an address off it \- see +.B BUGS +and +.IR ipconfig (8). +A copy of this file per card is the shape to use; one +.I fw +per card is the only shape there is. .SH BOOT .B /lib/fw/fwstart starts a firewall for each card named in @@ -442,6 +503,10 @@ starts one firewall per card at boot .B /lib/ndb/fw which cards are filtered, and with what .TP +.B /lib/svc/fw.ether0 +an example service file for +.IR init (8) +.TP .B /mnt/fw control files .TP @@ -459,6 +524,7 @@ are recorded .IR dial (2), .IR syslog (2), .IR fork (2), +.IR init (8), .IR ipconfig (8) .SH BUGS There is no address translation. |