Function render 

pub fn render(
    backend: Backend,
    plan: &FirewallPlan,
    executable: Option<&Path>,
) -> Vec<AdmitCommand>

The commands that admit the plan on the backend. ufw and nftables take one rule per source network; the macOS application firewall admits an executable, so it takes the executable the server runs as, once, whatever the ports — and nothing, when no executable is given.

use std::net::Ipv4Addr;
use std::path::Path;
use majordomus_cli::mesh::firewall::{plan, render, Backend};
use majordomus_cli::mesh::MeshConfig;

let config: MeshConfig = serde_json::from_value(serde_json::json!({
    "schema": "mesh/v1", "kind": "mesh-declaration", "id": "doc", "enabled": true,
    "rendezvous": { "endpoints": ["http://192.168.7.10:8791"] },
})).unwrap();
let p = plan(Some(&config), &[Ipv4Addr::new(192, 168, 7, 10)], None);
let lines: Vec<String> = render(Backend::Ufw, &p, None).into_iter().map(|c| c.line).collect();
assert_eq!(lines, [
    "ufw allow in proto udp to 239.255.77.77 port 7741 comment 'majordomus mesh: multicast discovery'",
    "ufw allow in proto tcp from 192.168.7.0/24 to any port 8791 comment 'majordomus mesh: rendezvous hub'",
]);
let mac = render(Backend::ApplicationFirewall, &p, Some(Path::new("/opt/majordomus")));
assert_eq!(mac.len(), 2);
assert!(mac[0].line.ends_with("--add /opt/majordomus"));
assert!(mac[1].line.ends_with("--unblockapp /opt/majordomus"));
assert!(render(Backend::None, &p, None).is_empty());