table inet filter {
    set cluster {
        type ipv4_addr; flags interval; auto-merge
        elements = {
{{ nodes | map('device_address') | flatten | selectattr('family.value', '==', 4) | map(attribute='address') | join(',\n') | indent(12, first=True) }}
        }
    }
    set cluster/6 {
        type ipv6_addr; flags interval; auto-merge
        elements = {
{{ nodes | map('device_address') | flatten | selectattr('family.value', '==', 6) | map(attribute='address') | join(',\n') | indent(12, first=True) }}
        }
    }

    # Just a temporary filter until we get our shit together policy-wise.
    set allowed {
        type ipv4_addr; flags interval
        elements = { 10.32.0.0/14, 193.2.76.176/24, 192.168.251.0/24, 88.200.23.0/24 }
    }
    set allowed/6 {
        type ipv6_addr; flags interval
        elements = { 2001:1470:fffd:3432::/64, 2001:1470:fffd:a000::/64 }
    }

    chain input {
        # BGP / BFD sessions
        iif lan0 ip6 saddr fe80::/64 accept
        iif lan1 ip6 saddr fe80::/64 accept

        iifname mgmt accept comment "management access"

        ip saddr @cluster accept comment "accept connections from other nodes"
        ip6 saddr @cluster/6 accept comment "accept connections from other nodes"

        ip saddr @allowed accept # TODO remove exceptions
        ip6 saddr @allowed/6 accept # TODO remove exceptions

        meta nfproto ipv6 tcp dport 80 accept comment "for certificate renewal"

{% for service in cluster_services %}
{% set prefixes = service | allowed_prefixes %}
{% set ports = service.ports | compact_numlist %}
        # service {{ service.name }}
{% if prefixes | ipv4 %}
        ip saddr { {{ prefixes | ipv4 | join(', ') }} } tcp dport { {{ ports }} } accept
{% endif %}
{% if prefixes | ipv6 %}
        ip6 saddr { {{ prefixes | ipv6 | join(', ') }} } tcp dport { {{ ports }} } accept
{% endif %}

{% endfor %}
    }
}