simplify iptables job

jobs/iptables/monit

@@ -1,5 +1,5 @@
 check file iptables
   with path /var/vcap/sys/run/iptables/iptables.check
-  start program "/var/vcap/jobs/iptables/bin/monit_debugger iptables_ctl '/var/vcap/jobs/iptables/bin/iptables_ctl start'"
-  stop program "/var/vcap/jobs/iptables/bin/monit_debugger iptables_ctl '/var/vcap/jobs/iptables/bin/iptables_ctl stop'"
+  start program "/var/vcap/jobs/iptables/bin/ctl start"
+  stop program "/var/vcap/jobs/iptables/bin/ctl stop"
   group vcap

jobs/iptables/spec

@@ -1,19 +1,16 @@
 ---
 name: iptables
-packages: []
+
 templates:
-  bin/monit_debugger: bin/monit_debugger
-  bin/iptables_ctl: bin/iptables_ctl
-  bin/enable_rules.sh.erb: bin/enable_rules.sh
-  bin/disable_rules.sh.erb: bin/disable_rules.sh
-  data/properties.sh.erb: data/properties.sh
-  helpers/ctl_setup.sh: helpers/ctl_setup.sh
-  helpers/ctl_utils.sh: helpers/ctl_utils.sh
+  bin/ctl: bin/ctl
+  bin/enable.sh: bin/enable.sh
+  bin/disable.sh: bin/disable.sh
+
 properties:
   iptables:
     description: "Map of rules per chain per table to apply in iptables"
-    example: |
-      iptables:
-        nat: # must match a valid iptables table (nat, filter, raw, mangle, security)
-          POSTROUTING: # must match an existing iptables chain for the above table
-          - -s 10.244.0.0/24 -j MASQUERADE # must be a valid iptables rule expression
+    default: {}
+    example:
+      nat:            # one of: nat, filter, raw, mangle, security
+        POSTROUTING:  # a valid chain
+        - -s 10.244.0.0/24 -j MASQUERADE

jobs/iptables/templates/bin/ctl

@@ -0,0 +1,22 @@
+#!/bin/bash
+
+set -e -u
+
+mkdir -p /var/vcap/sys/run/iptables
+
+case $1 in
+
+  start)
+      /var/vcap/jobs/iptables/bin/enable.sh
+      touch /var/vcap/sys/run/iptables/iptables.check
+      ;;
+
+  stop)
+      /var/vcap/jobs/iptables/bin/disable.sh
+      rm /var/vcap/sys/run/iptables/iptables.check
+      ;;
+  *)
+
+esac
+
+exit 0

jobs/iptables/templates/bin/disable.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+
+<% p("iptables").each do |table, chains|
+	chains.each do |chain, rules| %>
+
+iptables -t "<%= table %>" -F "pfbr-custom-<%= chain %>"
+
+	<% end %>
+<% end %>

jobs/iptables/templates/bin/enable_rules.sh.erb → jobs/iptables/templates/bin/enable.sh

@@ -16,15 +16,14 @@ function setup_chain {
 	fi
 }
 
-<% if_p("iptables") do |tables|
-tables.each do |table, chains|
-	chains.each do |chain, rules|
-%>
+<% p("iptables").each do |table, chains|
+	chains.each do |chain, rules| %>
+
 setup_chain "<%= table %>" "<%= chain %>" "pfbr-custom-<%= chain %>"
 
 <% rules.each do |rule| %>
 	iptables -t "${table}" -A "pfbr-custom-<%= chain %>"  <%= rule %>
 <% end %>
-<% end %>
-<% end %>
+
+	<% end %>
 <% end %>