From ac0654daf06a9d01fd264d96c00c8ab47b90cb73 Mon Sep 17 00:00:00 2001
From: sommerfeld <sommerfeld@sommerfeld.dev>
Date: Wed, 13 May 2026 13:43:22 +0100
Subject: feat(net): nftables laptop firewall

Default-deny inbound, allow outbound. Scoped to 'inet filter' with
'destroy table' on reload so podman/netavark tables are preserved.

- meta/base.txt: add nftables
- systemd-units/system/base.txt: enable nftables.service
- etc/nftables.conf: laptop ruleset (loopback, ct state, ICMP/ICMPv6
  essentials, DHCPv6 client, default-drop input/forward, accept output)
- etc/sysctl.d/99-sysctl.conf: rp_filter=2, no redirects, no source-route,
  log_martians
- README.md: firewall section with reload caveat
---
 meta/base.txt | 1 +
 1 file changed, 1 insertion(+)

(limited to 'meta')

diff --git a/meta/base.txt b/meta/base.txt
index da40c3c..f3c3e5a 100644
--- a/meta/base.txt
+++ b/meta/base.txt
@@ -27,6 +27,7 @@ man-db
 man-pages
 neovim
 nfs-utils
+nftables
 nmap
 ocl-icd
 openssh
-- 
cgit v1.3.1