slv-nftables

# SLV nftables Skill Inventory-driven nftables ruleset deployer. One playbook (`cmn/deploy_nftables.yml`) serves every slv role — Hermes, Pythnet RPC, Solana RPC, validators — by reading the firewall description from the same inventory that already configures the service itself. ## What it does 1. Renders `/etc/nftables.conf` + fragments under `/etc/nftables.d/` and `/etc/nftables.sets.d/` from Jinja2 templates. 2. Validates the rendered config (`nft -c`) before applying. If validation fails, the previous config is restored and the playbook aborts — you cannot lock yourself out via a bad template. 3. Applies atomically (`nft -f`). 4. Seeds allowlist sets with IPs from inventory, preserving any elements added at runtime with `nft add element …` so re-running the playbook never wipes manual additions. 5. Exports the live ruleset back into `/etc/nftables.conf` and enables `nftables.service` so the same ruleset is restored on reboot. ## Ruleset shape ``` chain input (default: drop) ├─ accept loopback ├─ accept established/related ├─ accept icmp / icmpv6 ├─ banAll_v4 drop (highest priority) ├─ mgmt_ips_v4 accept (full access) ├─ allowAll_v4 accept (runtime additions, full access) ├─ mgmt_ips_v4 → tcp dport ssh_port accept (belt-and-suspenders) ├─ public_tcp_ports / public_udp_ports accept └─ restricted_ports[]: allow_<port>_v4 accept else drop ``` ## Inventory variables | Vari...