This can be moved to line 48, and the other service can be implemented, it shouldn't be difficult to look up the port and protocol.

Doesn't SSH auto mode need this to work?

The other services will be implemented in later PRs.
For SSH, I'm considering if we should implement dynamic firewall control in xapi, as SSH service can be changed not only by xapi, but also by xapi-monitor-ssh, and systemd command directly.
Maybe we can just simply leave it opening.
Another option is to add the firewall-cmd to ExecStartPre and ExecStopPost of sshd systemd definition file.
What's your thought? @psafont

For SSH, I'm considering if we should implement dynamic firewall control in xapi, as SSH service can be changed not only by xapi, but also by xapi-monitor-ssh, and systemd command directly.

xapi-monitor-ssh needs to work even if xapi is not working, but there are rpc functions exposed in xapi that need to do the same. I think it makes sense that xapi uses this interface to open and close the SSH port; and ideally xapi-monitor-ssh would be done in ocaml and use the same library, otherwise it will need to duplicate the functionality somehow

xapi-monitor-ssh is written in Python.

I think the easiest way to dynamic update sshd port is to add ExecStartPre and ExecStopPost to systemd definition file, as both xapi and ssh-monitor-ssh calls systemd to manage sshd. This can avoid the duplication.

I don't know the exact requirements from xenserver, but as far as I'm aware:

• Switching of and on a single system instead of 2 means there's less chance of getting recovery and updates wrong. This means that I prefer a solution that blocks the port to the solution that blocks the ports and starts and stops the ssh daemon.
• Sharing a module of code to open a close ports between different daemons means that it only needs one set of sets instead.
• Modifying upstream service files and code increases maintenance costs, and as such I would avoid using ExecStartPre and ExecStopPost

So my preference would be to use this module both on xapi and xapi-monitor-ssh as the single mechanism to interrupt and enable access to SSH. But as I said previously, this is without knowing xenserver's feature requirements

The requirement comes from engineers instead of customers. It's to avoid the difference between a port being firewalled and not having a listening service when doing the port scan.
xapi-monitor-ssh is written by Python. I don't think we should rewrite it with Ocaml to use the same firewall module (or do you mean call this module in the Python code?). If we have to implement it in both xapi and xapi-monitor-ssh, I think we can just implement it in the existing Python code.