asxpi/nixOS
asxpi/nixOS
1
0
Fork 0
Code Issues Pull requests Activity

hostel-wifi: hardened profile for untrusted networks (disabled by default)

Browse source 
Add modules/hostel-wifi.nix: per-SSID MAC randomization (iwd), disable
mDNS/LLMNR/NetBIOS, reject hostile IPv6 RAs, firewall LAN-side probing,
an nftables killswitch target allowing only tunnel egress + captive-portal
endpoints, NTS-secured time via chrony, and a captive-portal helper.
Import left commented out; toggle via 'untrusted on|off'.
This commit is contained in:
Sergei Poljanski 2026-06-02 14:07:38 +03:00
commit 554487a136
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
2 changed files with 166 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
configuration.nix
View file

@ -19,6 +19,7 @@
./modules/xray.nix
./modules/ollama.nix
./modules/gaming.nix
# ./modules/hostel-wifi.nix # disabled 2026-05-08 — re-enable when needed
];
# This value determines the NixOS release from which the default