Devcontainer update

.devcontainer/devcontainer.json

@@ -9,6 +9,9 @@
       "KERNEL_UBUNTU_TAG": "061014"
     }
   },
+  "mounts": [
+    "source=${localWorkspaceFolder},target=/home/vscode/workspace,type=bind"
+  ],
   "runArgs": [
     "--privileged",
     "--cap-add=SYS_ADMIN",
@@ -29,7 +32,7 @@
     }
   },
   "remoteUser": "vscode",
+  "postCreateCommand": "sudo bpftool btf dump file /sys/kernel/btf/vmlinux format c > /home/vscode/workspace/vmlinux.h || true",
   "postStartCommand": "sudo mount -t bpf bpf /sys/fs/bpf || true && sudo mount -t debugfs none /sys/kernel/debug || true && sudo sysctl -w kernel.unprivileged_bpf_disabled=0 || true && sudo ulimit -l unlimited || true",
-  "postCreateCommand": "if [ -r /sys/kernel/btf/vmlinux ]; then /usr/local/bin/bpftool btf dump file /sys/kernel/btf/vmlinux format c > /home/vscode/vmlinux.h; else echo 'Skipping vmlinux.h generation: /sys/kernel/btf/vmlinux is unavailable'; fi && git clone git@github.com:arxignis/citadel.git /home/vscode/workspace && mkdir -p /home/vscode/workspace/src/security/firewall/bpf/include && if [ -f /home/vscode/vmlinux.h ]; then cp /home/vscode/vmlinux.h /home/vscode/workspace/src/security/firewall/bpf/include/vmlinux.h; fi",
   "workspaceFolder": "/home/vscode/workspace"
 }

.gitignore

@@ -55,3 +55,5 @@ AGENTS.md
 
 # BPF vmlinux.h (generated from kernel headers)
 src/security/firewall/bpf/include/vmlinux.h
+
+vmlinux.h

src/security/access_rules.rs

@@ -668,7 +668,17 @@ fn apply_rules(
     // Check if rules have changed
     let ipv4_changed = *previous_rules_guard != current_rules;
     let ipv6_changed = *previous_rules_v6_guard != current_rules_v6;
+
+    log::debug!(
+        "Rate limiter config comparison - previous: {:?}, current: {:?}",
+        *previous_rate_limiter_config,
+        rule.config.rate_limit
+    );
     let rate_limiter_config_changed = *previous_rate_limiter_config != rule.config.rate_limit;
+    log::debug!(
+        "Rate limiter config changed: {}",
+        rate_limiter_config_changed
+    );
 
     // If neither family changed, skip quietly with a single log entry
     if ipv4_changed || ipv6_changed {
@@ -757,16 +767,16 @@ fn apply_rules(
             let mut ratelimit = XDPRateLimit::new(&mut skel_ref);
             ratelimit.setup_from_config(&rule.config.rate_limit);
 
-            log::debug!("Successfully set XDP ratelimter config via access rules");
+            log::info!("Successfully set XDP ratelimter config via access rules");
         }
 
-        if rate_limiter_config_changed {
-            *previous_rate_limiter_config = rule.config.rate_limit.clone();
-        }
+        *previous_rate_limiter_config = rule.config.rate_limit.clone();
     } else {
-        log::debug!("No XDP rate limiter config cahnges detected, skipping update");
+        log::debug!("No XDP rate limiter config changes detected, skipping update");
     }
 
+    log::debug!("{:?}", rule.config.rate_limit);
+
     Ok(())
 }
 

src/worker/config.rs

@@ -31,7 +31,7 @@ pub struct Config {
 
 #[derive(Debug, Clone, Deserialize, Serialize, Default)]
 pub struct AccessRuleConfig {
-    #[serde(default, rename = "rateLimit")]
+    #[serde(default)]
     pub rate_limit: XDPRateLimitConfig,
 }