94ab6043e7
Add the files that land in the image, organised as layered rootfs trees (base first, then the edition layer wins on conflict). - base: hardened kernel cmdline + sysctl, default-deny nftables, key-only ssh, persistent journald, module blacklist, no core dumps, snapshot timer units, motd. - server: Prometheus + auto-provisioned Grafana + Loki + promtail. - workstation: dev profile and desktop sysctl relaxations (perf, rootless containers). - cloud: cloud-init provisioning config.
45 lines
1.5 KiB
Plaintext
45 lines
1.5 KiB
Plaintext
#!/usr/sbin/nft -f
|
|
# Arcline OS — default-deny firewall (nftables)
|
|
# Every edition ships with this policy: drop inbound by default, allow only
|
|
# what you opt in to. Services in `accept` rules are the baseline; add yours
|
|
# with `nft add rule inet filter input tcp dport <port> accept` (or edit this
|
|
# file and reload with `systemctl reload nftables`).
|
|
|
|
flush ruleset
|
|
|
|
table inet filter {
|
|
chain input {
|
|
type filter hook input priority filter; policy drop;
|
|
|
|
# established traffic is fine
|
|
ct state established,related accept
|
|
# loopback always
|
|
iif "lo" accept
|
|
# drop invalid packets early
|
|
ct state invalid drop
|
|
|
|
# ICMP (needed for PMTU discovery; rate-limited by kernel)
|
|
ip protocol icmp accept
|
|
ip6 nexthdr icmpv6 accept
|
|
|
|
# baseline services
|
|
# ssh (key-based auth only — see sshd_config.d)
|
|
tcp dport 22 accept
|
|
# web (commented out by default; enable when hosting)
|
|
# tcp dport 80 accept
|
|
# tcp dport 443 accept
|
|
}
|
|
|
|
chain forward {
|
|
type filter hook forward priority filter; policy drop;
|
|
# containers route via their own bridge tables (docker/podman);
|
|
# this chain stays drop for anything else.
|
|
}
|
|
|
|
chain output {
|
|
type filter hook output priority filter; policy accept;
|
|
# zero telemetry means we never call out — but we don't block
|
|
# outgoing by default. Arcline never phones home on its own.
|
|
}
|
|
}
|