diff options
| author |  sommerfeld <sommerfeld@sommerfeld.dev> | 2026-05-13 13:43:36 +0100 |
|---|---|---|
| committer | sommerfeld <sommerfeld@sommerfeld.dev> | 2026-05-13 13:43:36 +0100 |
| commit | fd06e5313c257648b10a56b9c4151d701fba7d43 (patch) | |
| tree | 53490bd5a7277b914ddef715dd3991c5b927b221 /etc/nix/nix.conf | |
| parent | 767a54e48163ea0db701c926e6bf69f2237fce33 (diff) | |
| download | dotfiles-fd06e5313c257648b10a56b9c4151d701fba7d43.tar.gz dotfiles-fd06e5313c257648b10a56b9c4151d701fba7d43.tar.bz2 dotfiles-fd06e5313c257648b10a56b9c4151d701fba7d43.zip | |
refactor(nftables): minimize diff against upstream pristine
The previous custom config rewrote the file to 4-space indentation,
added an explicit accept-policy output chain, and expanded the icmp
section into per-type whitelists. None of that changed observable
behaviour vs the stock arch nftables.conf:
* Stock already uses scoped `destroy table inet filter` (so podman
and netavark tables survive a reload).
* `meta l4proto { icmp, icmpv6 } accept` already covers NDP, MLD,
PMTUD, and echo — the explicit per-type list was equivalent.
* Without an output chain, outbound traffic is unfiltered, which is
identical to `policy accept` on an explicit output chain.
* DHCPv6 client (UDP/546) is only needed on networks that hand out
DHCPv6 leases; my home/work LANs use SLAAC + RDNSS, and the rare
DHCPv6 case can be added back in one line if it ever bites.
The only laptop-specific deviation is dropping the
`tcp dport ssh accept` line — no inbound SSH on a portable machine.
Net diff against pristine is now a single deletion, which makes
`just etc-upstream-diff` actually useful for spotting upstream
ruleset improvements on package updates.
Diffstat (limited to 'etc/nix/nix.conf')
| -rw-r--r-- | etc/nix/nix.conf | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/etc/nix/nix.conf b/etc/nix/nix.conf index eb24511..633422b 100644 --- a/etc/nix/nix.conf +++ b/etc/nix/nix.conf @@ -1,5 +1,9 @@ -# /etc/nix/nix.conf — daemon-wide Nix config. -# Managed by chezmoi (etc/nix/nix.conf in dotfiles). +# +# https://nixos.org/manual/nix/stable/#sec-conf-file +# + +# Unix group containing the Nix build user accounts +build-users-group = nixbld # Enable `nix` CLI (vs legacy nix-* commands) and flakes. experimental-features = nix-command flakes |