fix: add service to reload podman network on firewalld changes (#91)

README.md

@@ -85,6 +85,13 @@ Note: `libvirtd` is enabled by default, but only starts when triggerd by it's so
 
 NOTE: CoreOS [cautions against](https://docs.fedoraproject.org/en-US/fedora-coreos/faq/#_can_i_run_containers_via_docker_and_podman_at_the_same_time) running podman and docker containers at the same time.  Thus, `docker.socket` is disabled by default to prevent accidental activation of the docker daemon, given podman is the default.
 
+### Podman and FirewallD
+
+Podman and firewalld [can sometimes conflict](https://github.com/ublue-os/ucore/issues/90) such that a `firewall-cmd --reload` removes firewall rules generated by podman.
+
+A service is included to mitigate this by monitoring for firewall reload events on dbus and then reloading podman networks. If needed, enable like so: `systemctl enable --now podman-firewalld-reload.service`
+
+
 ### Distrobox
 
 Users may use [distrobox](https://github.com/89luca89/distrobox) to run images of mutable distributions where applications can be installed with traditional package managers. This may be useful for installing interactive utilities such has `htop`, `nmap`, etc. As stated above, however, *services* should run as containers.

main/packages.json

@@ -7,6 +7,7 @@
                 "cockpit-selinux",
                 "cockpit-storaged",
                 "cockpit-system",
+                "dbus-tools",
                 "distrobox",
                 "firewalld",
                 "open-vm-tools",

main/usr/lib/systemd/system/podman-firewalld-reload.service

@@ -0,0 +1,16 @@
+#
+# From: https://github.com/containers/podman/issues/5431#issuecomment-1022121559
+#
+[Unit]
+Description=Redo podman NAT rules after firewalld starts or reloads
+Wants=dbus.service
+After=dbus.service
+
+[Service]
+Type=simple
+Environment=LC_CTYPE=C.utf8
+ExecStart=/bin/bash -c "dbus-monitor --profile --system 'type=signal,sender=org.freedesktop.DBus,path=/org/freedesktop/DBus,interface=org.freedesktop.DBus,member=NameAcquired,arg0=org.fedoraproject.FirewallD1' 'type=signal,path=/org/fedoraproject/FirewallD1,interface=org.fedoraproject.FirewallD1,member=Reloaded' | sed -u '/^#/d' | while read -r type timestamp serial sender destination path interface member _junk; do if [[ $type = '#'* ]]; then continue; elif [[ $interface = org.freedesktop.DBus && $member = NameAcquired ]]; then echo 'firewalld started'; podman network reload --all; elif [[ $interface = org.fedoraproject.FirewallD1 && $member = Reloaded ]]; then echo 'firewalld reloaded'; podman network reload --all; fi; done"
+Restart=always
+
+[Install]
+WantedBy=multi-user.target