sync 2026-09-26 18:19 UTC

 1672 files changed, 151396 insertions(+)

4 files changed, 143 insertions, 0 deletions

diff --git a/opt/nftables/.footprint b/opt/nftables/.footprint
new file mode 100644
index 0000000..4dab9b7
--- /dev/null
+++ b/opt/nftables/.footprint
@@ -0,0 +1,43 @@
+drwxr-xr-x	root/root	etc/
+drwxr-xr-x	root/root	etc/nftables/
+drwxr-xr-x	root/root	etc/nftables/osf/
+-rw-r--r--	root/root	etc/nftables/osf/pf.os
+drwxr-xr-x	root/root	etc/sv/
+drwxr-xr-x	root/root	etc/sv/nftables/
+-rwxr-xr-x	root/root	etc/sv/nftables/finish
+-rwxr-xr-x	root/root	etc/sv/nftables/run
+drwxr-xr-x	root/root	etc/sv/nftables/log/
+-rwxr-xr-x	root/root	etc/sv/nftables/log/run
+drwxr-xr-x	root/root	usr/
+drwxr-xr-x	root/root	usr/bin/
+-rwxr-xr-x	root/root	usr/bin/nft
+drwxr-xr-x	root/root	usr/include/
+drwxr-xr-x	root/root	usr/include/nftables/
+-rw-r--r--	root/root	usr/include/nftables/libnftables.h
+drwxr-xr-x	root/root	usr/lib/
+-rwxr-xr-x	root/root	usr/lib/libnftables.so.1.1.0
+lrwxrwxrwx	root/root	usr/lib/libnftables.so -> libnftables.so.1.1.0
+lrwxrwxrwx	root/root	usr/lib/libnftables.so.1 -> libnftables.so.1.1.0
+drwxr-xr-x	root/root	usr/lib/pkgconfig/
+-rw-r--r--	root/root	usr/lib/pkgconfig/libnftables.pc
+drwxr-xr-x	root/root	usr/share/
+drwxr-xr-x	root/root	usr/share/nftables/
+-rw-r--r--	root/root	usr/share/nftables/all-in-one.nft
+-rw-r--r--	root/root	usr/share/nftables/arp-filter.nft
+-rw-r--r--	root/root	usr/share/nftables/bridge-filter.nft
+-rw-r--r--	root/root	usr/share/nftables/inet-filter.nft
+-rw-r--r--	root/root	usr/share/nftables/inet-nat.nft
+-rw-r--r--	root/root	usr/share/nftables/ipv4-filter.nft
+-rw-r--r--	root/root	usr/share/nftables/ipv4-mangle.nft
+-rw-r--r--	root/root	usr/share/nftables/ipv4-nat.nft
+-rw-r--r--	root/root	usr/share/nftables/ipv4-raw.nft
+-rw-r--r--	root/root	usr/share/nftables/ipv6-filter.nft
+-rw-r--r--	root/root	usr/share/nftables/ipv6-mangle.nft
+-rw-r--r--	root/root	usr/share/nftables/ipv6-nat.nft
+-rw-r--r--	root/root	usr/share/nftables/ipv6-raw.nft
+-rw-r--r--	root/root	usr/share/nftables/netdev-ingress.nft
+drwxr-xr-x	root/root	var/
+drwxr-xr-x	root/root	var/lib/
+drwxr-xr-x	root/root	var/lib/pkg/
+drwxr-xr-x	root/root	var/lib/pkg/meta/
+-rw-r--r--	root/root	var/lib/pkg/meta/nftables
diff --git a/opt/nftables/.signature b/opt/nftables/.signature
new file mode 100644
index 0000000..5c5aa09
--- /dev/null
+++ b/opt/nftables/.signature
@@ -0,0 +1,6 @@
+RWTZ9IduCSQ/mI9sq7d6oCuRXeVIBM7rPpsDbRDFeNgE4sZA/iT33kY//h25xjIJTSOigTMsm1zFb0yQX5mK4yso6fWx50ynHQc=
+
+SHA256 (MAKEPKG) = 1970492e24ccb99f0d580f6d43576ed336111ad73d89c19db6bd1e786c1ea650
+SHA256 (.footprint) = f9842823089e1f9df9d66860c8d9ce973602fe63477ef0909edb768cf77cbbbc
+SHA256 (nftables-1.1.7.tar.xz) = a6fbf060d8d4fff001517a2b94f356bb4366bfbf0ba366366f9d27cc38caa58f
+SHA256 (nftables#1.1.7-1.pkg.tar.gz) = 7d50c935c4e2731b921fb6d44d71fbf6cffb9bb8c22ffd1ae27a48fb4fdb1779
diff --git a/opt/nftables/MAKEPKG b/opt/nftables/MAKEPKG
new file mode 100644
index 0000000..2dc8d4e
--- /dev/null
+++ b/opt/nftables/MAKEPKG
@@ -0,0 +1,73 @@
+#!/bin/mkpkg
+# description: Netfilter nftables - firewalling, NAT, and packet mangling for Linux (minimal)
+# url: https://netfilter.org/projects/nftables/
+
+# Note: This is a minimal build WITHOUT Python bindings
+
+name=nftables
+version=1.1.7
+release=1
+depends=(libmnl libnftnl libedit gmp)
+makedeps=(bison flex)
+groups=(nftables)
+services=(nftables)
+source=(
+    https://www.netfilter.org/pub/nftables/nftables-$version.tar.xz
+)
+sha256sums=(
+    "a6fbf060d8d4fff001517a2b94f356bb4366bfbf0ba366366f9d27cc38caa58f"
+)
+
+build() {
+    cd $name-$version
+    export CONFIG_SHELL=/bin/bash
+    ./configure \
+        --prefix=/usr \
+        --sbindir=/usr/bin \
+        --sysconfdir=/etc \
+        --with-cli=editline \
+        --without-json \
+        --without-python-bin \
+        --disable-debug \
+        --disable-man-doc \
+        --disable-python
+    make
+    make DESTDIR=$PKG install
+
+    rm -rf $PKG/usr/share/doc
+}
+
+post_build() {
+    # runit service
+    install -d $PKG/etc/sv/nftables/log
+
+    printf '%s\n' \
+        '#!/bin/sh' \
+        'exec 2>&1' \
+        '[ ! -r /etc/nftables.conf ] && exit 0' \
+        'nft -f /etc/nftables.conf' \
+        'exec chpst -b nftables pause' \
+        > $PKG/etc/sv/nftables/run
+
+    printf '%s\n' \
+        '#!/bin/sh' \
+        'nft flush ruleset' \
+        > $PKG/etc/sv/nftables/finish
+
+    printf '%s\n' \
+        '#!/bin/sh' \
+        'mkdir -p /var/log/nftables' \
+        'exec svlogd -tt /var/log/nftables' \
+        > $PKG/etc/sv/nftables/log/run
+
+    chmod 755 $PKG/etc/sv/nftables/run
+    chmod 755 $PKG/etc/sv/nftables/finish
+    chmod 755 $PKG/etc/sv/nftables/log/run
+}
+
+signify() {
+    untrusted comment: public key
+    RWTZ9IduCSQ/mL8337TEUinPwT92xFEUpD92hkS7IxcOnzTt9QdpohT3
+}
+
+# vim: filetype=sh
diff --git a/opt/nftables/nftables.conf b/opt/nftables/nftables.conf
new file mode 100644
index 0000000..c0b3b27
--- /dev/null
+++ b/opt/nftables/nftables.conf
@@ -0,0 +1,21 @@
+#!/usr/bin/nft -f
+
+## This is a basic workstation configuration based on
+## https://wiki.nftables.org/wiki-nftables/index.php/Simple_ruleset_for_a_workstation
+
+flush ruleset
+
+table ip filter {
+	chain input {
+	 	type filter hook input priority 0; policy drop;
+
+	 	# accept any localhost traffic
+	 	iif lo accept
+
+	 	# accept traffic originated from us
+	 	ct state established,related accept
+
+	 	# accept ssh logins via port 22
+	 	tcp dport 22 accept comment "Accept SSH on port 22"
+	}
+}