Firewall

Firewall treats network policy as source code. Zones and rules are authored in a Go and React editor, then compiled deterministically to OpenTofu. The same input always produces the same plan, reviewable in full before anything is applied.

How it works

The compiler is a single library with two front doors: the app uses it for live preview, and the CLI is what CI runs, so there’s no drift between what you see and what ships. Go was chosen for one decisive reason: HCL round-trip. The Go ecosystem is the only one with first-class HCL writing, so the existing imported rules parse and re-emit as syntax-guaranteed output. Code and data live in separate repos, so a Save is a single atomic commit. The app is credential-free and never touches the firewall hardware; a separate runner applies, and the app just polls task status behind one meter: Saved → Building → Planning → Applying → Verifying → In sync.

Key decisions

• Determinism over convenience: CI recompiles the committed output and fails the build unless it’s byte-identical to what shipped. Same input, same plan, always, so a review is a review of exactly what will run.
• Break-glass invariants are unshadowable: emergency-access rules are emitted first and checked at compile time; an edit that would lock them out is a compile error, not a 2am incident.
• The LLM advises, never approves: a structured risk verdict sits between plan and apply and can only escalate to a human; if it’s unreachable, the deploy proceeds with an annotation rather than blocking. Advice, not authority: the deterministic compiler stays the source of truth.
• Plan-surprise halts, never auto-applies: a plan whose diff exceeds the expected change set stops for confirmation, so an unexpected blast radius can’t slip through on momentum.