#4334 cfgmgmt firewall (ufw): an input for rule position (insert before/after)

What I'm trying to do. Orbit converges UFW rules on its Nodes with @swamp/cfgmgmt firewall. UFW stops at the first matching rule, so order matters: an operator's deny for one address has to sit above a broader allow, and narrower sources (one address, then a CIDR) above "anywhere".

What I do today. As far as I can tell, the ufw backend always appends a new rule, and there's no input for its position. So I keep one small script on each Node that reads ufw status numbered, works out the right position, and runs ufw insert N … under a lock. It's the last piece of my firewall handling that isn't a plain cfgmgmt step. I may have missed an existing way to do this; if so, a pointer would be great.

What would help. An optional position input for the ufw backend, for example one of:

• insertAt: <number>, passed through to ufw insert;
• before: <match> / after: <match>, using the same destination/comment matching #4230 added (thank you for that one).

It would also help if check reported drift when the rule exists but sits in the wrong position, so a converge can repair the order.

With that, I could drop the script and keep the whole firewall flow in official steps.

Upstream repository: https://github.com/swamp-club/swamp-extensions

Environment

• Extension: @swamp/cfgmgmt@2026.10.27.1
• swamp: 20261031.063736.0-sha.e459d219
• OS: linux (x86_64)
• Deno: 2.9.8
• Shell: /usr/bin/zsh