scaffold: aports overlay, build script, CI workflow, README

Kernel aport forked from pmaports 7.1.2-r0, repointed at milos-linux
combined-stable with the tested FP6 config (+EFI_ZBOOT for packaging);
imsd + nftables aports from the pending pmaports submission. build.sh
carries TODO(validate) markers - not yet run end-to-end.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

aports/main/postmarketos-config-nftables/rules/00_log_all.nft

@@ -0,0 +1,9 @@
+#!/usr/sbin/nft -f
+
+table inet filter {
+	chain input {
+
+		log
+
+	}
+}

aports/main/postmarketos-config-nftables/rules/01_imsd.nft

@@ -0,0 +1,15 @@
+#!/usr/sbin/nft -f
+
+table inet filter {
+	chain input {
+
+		# imsd's IPsec-protected SIP ports on the IMS PDN. Ordered before
+		# 01_wwan.nft's qmapmux drop: the ESP-decapsulated inbound flows
+		# arrive on qmapmux* and would be dropped there. The comment is
+		# load-bearing — imsd's ims-pdn-up.sh checks for it and skips its
+		# runtime rule insertion when this rule is present.
+		iifname "qmapmux*" tcp dport 45061-45062 accept comment "imsd-protected-ports"
+		iifname "qmapmux*" udp dport 45061-45062 accept comment "imsd-protected-ports"
+
+	}
+}

aports/main/postmarketos-config-nftables/rules/01_wwan.nft

@@ -0,0 +1,11 @@
+#!/usr/sbin/nft -f
+
+table inet filter {
+	chain input {
+
+		# drop all incoming connections on wwan
+		iifname "wwan*" drop comment "drop all connections on wwan"
+		iifname "qmapmux*" drop comment "drop all connections on qmapmux"
+
+	}
+}

aports/main/postmarketos-config-nftables/rules/10_dhcp.nft

@@ -0,0 +1,15 @@
+#!/usr/sbin/nft -f
+
+table inet filter {
+	chain input {
+
+		# Allow DHCP server on usb*
+		iifname "usb*" udp dport bootps accept comment "accept incoming DHCP on usb*"
+
+		# Allow DHCP server on wlan* for hotspot
+		iifname "wlan*" udp dport bootps accept comment "accept incoming DHCP on wlan*"
+
+		# Allow DHCP server on p2p-wlan* for WiFi Display
+		iifname "p2p-wlan*" udp dport bootps accept comment "accept incoming DHCP on p2p-wlan*"
+	}
+}

aports/main/postmarketos-config-nftables/rules/50_ausweisapp2.nft

@@ -0,0 +1,7 @@
+#!/usr/sbin/nft -f
+
+table inet filter {
+	chain input {
+		tcp dport 24727 accept comment "accept connections for BundID AusweisApp2"
+	}
+}

aports/main/postmarketos-config-nftables/rules/50_localsend.nft

@@ -0,0 +1,8 @@
+#!/usr/sbin/nft -f
+
+table inet filter {
+	chain input {
+		udp dport 53317 accept comment "localsend device discovery"
+		tcp dport 53317 accept comment "localsend file transfer"
+	}
+}

aports/main/postmarketos-config-nftables/rules/50_mdns.nft

@@ -0,0 +1,7 @@
+#!/usr/sbin/nft -f
+
+table inet filter {
+	chain input {
+		udp sport mdns udp dport mdns accept comment "accept incoming mDNS traffic"
+	}
+}

aports/main/postmarketos-config-nftables/rules/50_rdpserver.nft

@@ -0,0 +1,7 @@
+#!/usr/sbin/nft -f
+
+table inet filter {
+	chain input {
+		tcp dport 3389 accept comment "accept RDP"
+	}
+}

aports/main/postmarketos-config-nftables/rules/50_upnp_client.nft

@@ -0,0 +1,7 @@
+#!/usr/sbin/nft -f
+
+table inet filter {
+	chain input {
+		udp sport 1900 accept comment "accept SSDP/UPnP replies"
+	}
+}

aports/main/postmarketos-config-nftables/rules/50_vlc_chromecast.nft

@@ -0,0 +1,7 @@
+#!/usr/sbin/nft -f
+
+table inet filter {
+	chain input {
+		tcp dport 8010 accept comment "accept VLC Chromecast"
+	}
+}

aports/main/postmarketos-config-nftables/rules/50_vncserver.nft

@@ -0,0 +1,7 @@
+#!/usr/sbin/nft -f
+
+table inet filter {
+	chain input {
+		tcp dport 5900 accept comment "accept VNC"
+	}
+}

aports/main/postmarketos-config-nftables/rules/51_docker.nft

@@ -0,0 +1,11 @@
+#!/usr/sbin/nft -f
+table inet filter {
+	chain input {
+		iifname "docker*" accept comment "Allow incoming network traffic from Docker"
+	}
+
+	chain forward {
+		iifname "docker*" accept comment "Allow outgoing network traffic from Docker"
+		ct state {established, related} counter accept comment "accept established connections"
+	}
+}

aports/main/postmarketos-config-nftables/rules/51_hotspot.nft

@@ -0,0 +1,15 @@
+#!/usr/sbin/nft -f
+
+table inet filter {
+	chain input {
+
+		# allow DNS from wlan*
+		iifname "wlan*" tcp dport 53 accept comment "Accept DNS over TCP on wlan*"
+		iifname "wlan*" udp dport 53 accept comment "Accept DNS over UDP on wlan*"
+
+	}
+
+	chain forward {
+		iifname "wlan*" accept comment "Accept forwarding from wlan*"
+	}
+}

aports/main/postmarketos-config-nftables/rules/51_usb_inet.nft

@@ -0,0 +1,11 @@
+#!/usr/sbin/nft -f
+table inet filter {
+	chain input {
+		iifname "usb*" accept comment "Allow incoming network traffic from USB"
+	}
+	chain forward {
+		iifname "usb*" accept comment "Allow outgoing network traffic from USB"
+		ct state {established, related} counter accept comment "accept established connections"
+	}
+}
+

aports/main/postmarketos-config-nftables/rules/51_wifi_display.nft

@@ -0,0 +1,10 @@
+#!/usr/sbin/nft -f
+
+table inet filter {
+	chain input {
+
+		# allow DNS from wlan*
+		iifname "p2p-wlan*" tcp dport 7236 accept comment "Accept Wi-Fi Display Protocol over TCP on p2p-wlan*"
+
+	}
+}

aports/main/postmarketos-config-nftables/rules/60_usb.nft

@@ -0,0 +1,13 @@
+#!/usr/sbin/nft -f
+
+# Allow all traffic from usb-ethernet interfaces for debugging
+# and porting.
+
+table inet filter {
+	chain input {
+
+		# allow all from USB net
+		iifname "usb*" accept comment "accept USB net"
+
+	}
+}

aports/main/postmarketos-config-nftables/rules/99_drop_log.nft

@@ -0,0 +1,9 @@
+#!/usr/sbin/nft -f
+
+table inet filter {
+	chain input {
+
+		log prefix "DROP:  " flags all drop
+
+	}
+}