fix set raw.dnsmasq breaks nftables

scripts/lxc-miaou-enable-ssh

@@ -54,7 +54,7 @@ EOF
         echo -n "building template for sshd_config..."
         USERS=${previous_users[*]} tera -e --env-key env -t "$MIAOU_BASEDIR/templates/dev-container-ssh/sshd_config.j2" -o "/tmp/sshd_config" "$MIAOU_CONFIGDIR/miaou.expanded.yaml" >/dev/null
         echo 'OK'
-        echo -n "copying sshd_config over container <$CONTAINER> ... "
+        echo -n "copying sshd_config to container <$CONTAINER> ... "
         lxc file push --uid 0 --gid 0 "/tmp/sshd_config" "$CONTAINER/etc/ssh/sshd_config" &>/dev/null
         echo 'OK'
         lxc exec "$CONTAINER" -- systemctl reload sshd.service

scripts/lxd-restart-dnsmasq

@@ -10,3 +10,7 @@ function restart_dnsmasq() {
 ## MAIN
 . "$MIAOU_BASEDIR/lib/init.sh"
 restart_dnsmasq
+
+echo "WARNING: restarting dnsmasq may break your NFT ruleset!"
+echo "You should reload NFTables as well..."
+echo "sudo systemctl reload nftables.service"

scripts/miaou

@@ -165,6 +165,8 @@ function expand_conf() {
 function build_routes() {
     PREFIX="miaou:routes"
 
+    mkdir -p "$MIAOU_CONFIGDIR/dnsmasq"
+
     mapfile -t fqdns < <(yqm '.expanded.services[].fqdn')
     echo "found <${#fqdns[@]}> fqdn"
     raw_dnsmasq=''
@@ -174,7 +176,17 @@ function build_routes() {
         echo "re-routing any connection from <$i> to internal container <$DMZ_CONTAINER.lxd>"
     done
 
-    builtin echo -e "$raw_dnsmasq" | lxc network set $BRIDGE raw.dnsmasq -
+    builtin echo -e "$raw_dnsmasq" >"$MIAOU_CONFIGDIR/dnsmasq/raw.new"
+    lxc network get $BRIDGE raw.dnsmasq | head -n-1 >"$MIAOU_CONFIGDIR/dnsmasq/raw.old"
+
+    if ! diff -q "$MIAOU_CONFIGDIR/dnsmasq/raw.old" "$MIAOU_CONFIGDIR/dnsmasq/raw.new"; then
+        echo "reload dnsmasq"
+        builtin echo -e "$raw_dnsmasq" | lxc network set $BRIDGE raw.dnsmasq -
+        echo "reload nftables"
+        sudo systemctl reload nftables.service
+    else
+        echo "no changes"
+    fi
 }
 
 function build_dmz_certbot {
@@ -548,10 +560,8 @@ if check_expand_conf; then
     check_resolv_conf
     build_nftables
     prepare_containers
-
     DMZ_CONTAINER=$(get_unique_container_dmz)
     build_dmz_reverseproxy
-
     DMZ_IP=$(get_dmz_ip)
     build_services
     build_dmz_certbot