This PR will enable using nested arrays for parameter 'set'.
It's required (e.g.) when grouping networks in Hiera.
```
ip4subnetaclass00: '10.0.1.0/24'
ip4subnetaclass01: '10.0.2.0/24'
ip4subnetsaclass:
- "%{alias('ip4subnetaclass00')}"
- "%{alias('ip4subnetaclass01')}"
ip4subnetcclass00: '192.168.0.0/24'
ip4subnetcclass01: '192.168.1.0/24'
ip4subnetscclass:
- "%{alias('ip4subnetcclass00')}"
- "%{alias('ip4subnetcclass01')}"
ip4subnets:
- "%{alias('ip4subnetsaclass')}"
- "%{alias('ip4subnets_cclass')}"
ipset::sets:
ip4subnets:
set: "%{alias('ip4subnets')}"
type: 'hash:net'
```
The current ipset service unit sets Before=network-pre.target
as it is needed before the network to help ensure that the firewall is up and running before anyone might actually try to connect. It has no setting
for DefaultDependencies
which means it takes the defaults, one of which is After=sysinit.target
.
There are some cases where this can cause a dependency cycle with other units that want to start early in the boot process between networking.service
and sysinit.target
(for example, cloud-init). This results in one of the offending units being removed and risks startup continuing without ipsets being configured, potentially leaving a firewall open and a host at risk.
The ipset service can safely be run before sysinit.target
by setting DefaultDependencies=no
with a couple of additional dependencies to handle some of the other implied settings that are removed as a result.
Fixes #63