feat(packages): add nftablesbuilder package

Web interface to manage nftables rules with drag-and-drop rule creation.

Upstream source is incomplete (missing settings crate, no GUI build
tooling), so the package builds the Rust workspace from the pinned
commit with a patched-in settings crate (schema recovered from official
release artifacts) and reuses the prebuilt GUI from the hash-pinned
release tarball on nftablesbuilder.eu.

packages/nftablesbuilder/default.nix

@@ -0,0 +1,5 @@
+{
+  pkgs,
+  ...
+}:
+pkgs.callPackage ./package.nix { }

packages/nftablesbuilder/package.nix

@@ -0,0 +1,69 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  fetchurl,
+  pkg-config,
+  openssl,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "nftablesbuilder";
+  # Pinned to a commit rather than a release tag because upstream
+  # publishes releases only as tarballs on nftablesbuilder.eu.
+  version = "0.1.0-unstable-2026-01-27";
+
+  src = fetchFromGitHub {
+    owner = "AiseBouma";
+    repo = "NftablesBuilder";
+    rev = "f414e921c2857556cdb4d602ed832a32a6951d25";
+    hash = "sha256-5qwyVXLrUxOk7poVdUyi/yJUq1CYMffruvAO0ONO+cI=";
+  };
+
+  # Upstream source is incomplete: both crates depend on a `settings`
+  # crate (path = "../settings") that was never committed, and the GUI
+  # has no build tooling (raw TSX, no package.json). This patch adds
+  # the missing settings crate (schema recovered from the official
+  # release artifacts) plus a workspace Cargo.toml.
+  patches = [ ./settings-workspace.patch ];
+
+  cargoLock.lockFile = ./Cargo.lock;
+
+  # Prebuilt GUI from the official release tarball, since the GUI cannot
+  # be built from source. Upstream serves releases with a self-signed
+  # TLS certificate, hence curlOpts = "-k"; the hash still pins content.
+  guiSrc = fetchurl {
+    url = "https://nftablesbuilder.eu/releases/latest/nftablesbuilder.tar.gz";
+    sha256 = "sha256-vHyuKVH4OtXEisWeDo+b3gHg3TzdXUSfMbaNpfQOrns=";
+    curlOpts = "-k";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ openssl ];
+
+  installPhase = ''
+    runHook preInstall
+
+    binDir=$(dirname "$(find target -type f -name nftablesbuilder -path '*/release/*' | head -1)")
+    install -Dm755 $binDir/nftablesbuilder $out/bin/nftablesbuilder
+    install -Dm755 $binDir/webserver $out/libexec/nftablesbuilder/webserver
+
+    mkdir -p $out/share/nftablesbuilder
+    tar -xzf $guiSrc -C $out/share/nftablesbuilder --strip-components=4 nftablesbuilder/root/opt/nftablesbuilder/html
+    install -Dm644 ${./settings.example} $out/share/nftablesbuilder/settings.example
+
+    runHook postInstall
+  '';
+
+  passthru = {
+    category = "Networking";
+  };
+
+  meta = with lib; {
+    description = "Web interface to manage nftables rules";
+    homepage = "https://github.com/AiseBouma/NftablesBuilder";
+    license = licenses.mit;
+    mainProgram = "nftablesbuilder";
+    platforms = platforms.linux;
+  };
+}

packages/nftablesbuilder/settings.example

@@ -0,0 +1,17 @@
+[connection]
+port = 1969
+
+[paths]
+savepath = "/var/lib/nftablesbuilder"
+htmlpath = "/run/current-system/sw/share/nftablesbuilder/html"
+
+[files]
+nft = "/run/current-system/sw/bin/nft"
+test = "/tmp/nftables.conf"
+conf = "/etc/nftables.conf"
+webserver = "/run/current-system/sw/libexec/nftablesbuilder/webserver"
+tlskey = "/var/lib/nftablesbuilder/nftables.key"
+tlscert = "/var/lib/nftablesbuilder/nftables.crt"
+
+[commands]
+reload = "systemctl reload nftables"