2 commits

Author	SHA1	Message	Date
Sergei Poljanski	8458e0645d	xray: config via sops, private routes spliced into sing-box at runtime	2026-07-14 12:24:33 +04:00
Sergei Poljanski	554487a136	hostel-wifi: hardened profile for untrusted networks (disabled by default) ... Add modules/hostel-wifi.nix: per-SSID MAC randomization (iwd), disable mDNS/LLMNR/NetBIOS, reject hostile IPv6 RAs, firewall LAN-side probing, an nftables killswitch target allowing only tunnel egress + captive-portal endpoints, NTS-secured time via chrony, and a captive-portal helper. Import left commented out; toggle via 'untrusted on|off'.	2026-06-02 14:07:38 +03:00