Piecuu/pmaports
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

main/postmarketos-config-nftables: rely on upstream nftrules

Browse source 
Upstream is now shipping rules as individual subpackages for packages
which require them. Rely on these by linking to them instead of
duplicating them here.

Note that the upstream packages only ship rules, but do not enable them
by default. This patch retains this package's current behaviour and
still automatically enables rules.

See: https://gitlab.alpinelinux.org/alpine/aports/-/merge_requests/67137
See: https://gitlab.postmarketos.org/postmarketOS/pmaports/-/issues/3934
Part-of: <https://gitlab.postmarketos.org/postmarketOS/pmaports/-/merge_requests/6991>
This commit is contained in:
Hugo Osvaldo Barrera 2025-09-01 18:08:30 +02:00 • committed by The Friendly Merge Bot
parent cb4a9bfd40
commit 7cb5f1d3e4
No known key found for this signature in database
3 changed files with 7 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

14
main/postmarketos-config-nftables/APKBUILD
View file

@ -1,11 +1,12 @@
# Maintainer: Clayton Craft <clayton@craftyguy.net>
pkgname=postmarketos-config-nftables
pkgver=0.16
pkgrel=2
pkgrel=3
pkgdesc="nftables firewall configuration for postmarketOS"
url="https://gitlab.com/postmarketos"
arch="noarch"
license="MIT"
depends="openssh-nftrules"
subpackages="
$pkgname-openusb:openusb
$pkgname-log:log
@ -24,12 +25,10 @@ source="
rules/01_wwan.nft
rules/10_dhcp.nft
rules/50_mdns.nft
rules/50_ssh.nft
rules/50_upnp_client.nft
rules/50_vlc_chromecast.nft
rules/50_vncserver.nft
rules/51_docker.nft
rules/51_moshserver.nft
rules/51_hotspot.nft
rules/51_usb_inet.nft
rules/51_wifi_display.nft
@ -44,6 +43,9 @@ package() {
for _i in ./*; do
install -Dm644 "$_i" "$pkgdir"/etc/nftables.d/"$_i"
done
ln -s ../../usr/share/nftables.avail/50_sshd.nft "$pkgdir/etc/nftables.d/50_sshd.nft"
ln -s ../../usr/share/nftables.avail/50_mosh.nft "$pkgdir/etc/nftables.d/50_mosh.nft"
}
openusb() {
@ -86,11 +88,11 @@ mdns() {
}
moshserver() {
depends="$pkgname"
depends="$pkgname mosh-nftrules"
description="Enables networking for mosh server"
install_if="$pkgname=$pkgver-r$pkgrel mosh-server"
amove etc/nftables.d/51_moshserver.nft
amove etc/nftables.d/50_mosh.nft
}
upnp_client() {
@ -137,12 +139,10 @@ sha512sums="
10b3ab4d1f98a669e88fb2113a3880c4bf410d68859fe6a3efe8d638e3060af4a829485aed8c8da226c7fb7a53bab1bc90a659cb8fad9ccd226d808dbba94caf 01_wwan.nft
ae6a8ac03d4643004f5ce9279083bc12a215ceb2ee66993a26ab5620bb1aab347541eb1729b38cc7ec9d232de07e0176bc59475669741dfa2588c9e1ec4a4958 10_dhcp.nft
597bf66783379691962f4b87a29e6219d5f87ef17d49b261c7b1eebe54561deafce4be77de3b39252c10b7b4452ac5b55870dd30605d7d0f074d27b06d1dfa6d 50_mdns.nft
136a95d2f21d2935dcd85d4c40d597fbddffb31126dbcbc78f1b286454b7623cf16f6059dea6040d35e8f14d8ac79e292cc51bd6675afedc6953a6793315c786 50_ssh.nft
5779bbcc55e411ec4da58e4e7eaaa6918cdcea5b8818cd72ab93be2d1108f020861457dbd8079a60b0912f84d05eb7b42274cc9a0577f66e8322f3596b89b411 50_upnp_client.nft
9207bef8d2df8d728521aef19f3c6ccb5c645a0295617b54722a6867c86b29c13502a01747eb3c91602f416f60bdc2bfa18dfb4906e17494923996596b6b1444 50_vlc_chromecast.nft
c688e768c709ad17685641a6ba543f84e8466080356712073e06108fc1707109f590be45b8a0aca8d0d95171c5afe69887f71b78fe56444912dd0582a461f477 50_vncserver.nft
76ac156ee80f895ab4f574f70f4ee9f960dfd23a3381bbbf7c744bea919b98f69e91e2eaa10425dfeaf5dbe77b745ec1dd82cb94953835873baffd9e5d89e166 51_docker.nft
59d93d0006aadb6f699836895119cf49a2fbbc1159cad4ab98868610cd6796da7fe792e7c845df93303a4cfa77658e0687b6726a8b0bcf613563f1a33d5588ab 51_moshserver.nft
1ce70bb71c9008b6c727a2c26d11467be3b5a0cb9815a8bb0790150c7958457b22b110e35ba974973b9579d44bd14219985d85597c954b5fa8cf77bf206c959b 51_hotspot.nft
ea7d8a652808ba6ae92de6dfc9f7d57415e411a04db3a41d1480f254b3a3a574558dbee2e7259e5d527527a11ca3aace7bb9edc7e023b0f4f67afceefeeb9e88 51_usb_inet.nft
c243534219eca3ea31504eef9ea88f8c2e00f2340e9dec3d381459a84a09a7390c8327eac43ae38155f6d7a059327cb26be63451a1ba280664fc1da81b27f7be 51_wifi_display.nft

8
main/postmarketos-config-nftables/rules/50_ssh.nft
View file

@ -1,8 +0,0 @@
#!/usr/sbin/nft -f
table inet filter {
chain input {
# allow ssh
tcp dport 22 accept comment "accept SSH"
}
}

10
main/postmarketos-config-nftables/rules/51_moshserver.nft
View file

@ -1,10 +0,0 @@
#!/usr/sbin/nft -f
table inet filter {
chain input {
# allow mosh
udp dport 60000-60010 accept comment "accept mosh"
}
}