#!/usr/sbin/nft -f
# Arcline OS — default-deny firewall (nftables)
# Every edition ships with this policy: drop inbound by default, allow only
# what you opt in to. Services in `accept` rules are the baseline; add yours
# with `nft add rule inet filter input tcp dport <port> accept` (or edit this
# file and reload with `systemctl reload nftables`).

flush ruleset

table inet filter {
    chain input {
        type filter hook input priority filter; policy drop;

        # established traffic is fine
        ct state established,related accept
        # loopback always
        iif "lo" accept
        # drop invalid packets early
        ct state invalid drop

        # ICMP (needed for PMTU discovery; rate-limited by kernel)
        ip protocol icmp accept
        ip6 nexthdr icmpv6 accept

        # baseline services
        # ssh (key-based auth only — see sshd_config.d)
        tcp dport 22 accept
        # web (commented out by default; enable when hosting)
        # tcp dport 80 accept
        # tcp dport 443 accept
    }

    chain forward {
        type filter hook forward priority filter; policy drop;
        # containers route via their own bridge tables (docker/podman);
        # this chain stays drop for anything else.
    }

    chain output {
        type filter hook output priority filter; policy accept;
        # zero telemetry means we never call out — but we don't block
        # outgoing by default. Arcline never phones home on its own.
    }
}