feat(packages): add nftablesbuilder package

Web interface to manage nftables rules with drag-and-drop rule creation.

Upstream source is incomplete (missing settings crate, no GUI build
tooling), so the package builds the Rust workspace from the pinned
commit with a patched-in settings crate (schema recovered from official
release artifacts) and reuses the prebuilt GUI from the hash-pinned
release tarball on nftablesbuilder.eu.

.beads/issues.jsonl

@@ -1 +1,2 @@
-{"_type":"issue","id":"nix-overlay-bjd","title":"Add nftables-analyzer CLI package","description":"Add python3Packages.buildPythonApplication derivation for reinaldosaraiva/nftables-analyzer (CLI only). Pin to main commit 5fc78d0c9ce173e3baa80a5655bcadb1b2f78493 (no tags upstream). sourceRoot=source/backend, hatchling build system. Category: Networking. Frontend excluded - upstream repo missing frontend/src/lib modules.","status":"in_progress","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-08-07T04:48:07Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-08-07T04:48:10Z","started_at":"2026-08-07T04:48:10Z","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"nix-overlay-f8c","title":"Add nftablesbuilder package","description":"Package NftablesBuilder (github.com/AiseBouma/NftablesBuilder) web interface to manage nftables. Upstream source is incomplete (missing settings crate, no GUI build tooling, no Cargo.lock) so: patch in authored settings crate (schema from release artifacts), build Rust workspace from pinned commit, reuse built GUI assets from hash-pinned release tarball.","status":"in_progress","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-08-07T04:58:22Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-08-07T04:58:25Z","started_at":"2026-08-07T04:58:25Z","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"nix-overlay-bjd","title":"Add nftables-analyzer CLI package","description":"Add python3Packages.buildPythonApplication derivation for reinaldosaraiva/nftables-analyzer (CLI only). Pin to main commit 5fc78d0c9ce173e3baa80a5655bcadb1b2f78493 (no tags upstream). sourceRoot=source/backend, hatchling build system. Category: Networking. Frontend excluded - upstream repo missing frontend/src/lib modules.","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-08-07T04:48:07Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-08-07T04:50:25Z","started_at":"2026-08-07T04:48:10Z","closed_at":"2026-08-07T04:50:25Z","close_reason":"Package added, built, smoke-tested, committed","dependency_count":0,"dependent_count":0,"comment_count":0}

README.md

@@ -21,6 +21,7 @@ A custom Nix overlay and flake providing additional packages not found in upstre
 | `hipengine` | ROCm-native local LLM inference engine with torch-free runtime for AMD RDNA GPUs | AI Inference |
 | `mcp-gateway` | Universal Model Context Protocol gateway that sits between AI client and MCP tools/servers | MCP Servers |
 | `nftables-analyzer` | Analyze nftables firewall rules and evaluate traffic queries | Networking |
+| `nftablesbuilder` | Web interface to manage nftables rules with drag-and-drop rule creation | Networking |
 | `skillsmcp` | MCP server that exposes Agent Skills to AI agents via the Model Context Protocol | MCP Servers |
 | `kubernetes-mcp-server` | Model Context Protocol (MCP) server for Kubernetes and OpenShift | MCP Servers |
 | `loop` | Corporate messenger for your team | Communication |
@@ -83,6 +84,31 @@ nix run git+https://git.millerson.name/alex/millerson-overlay.nix.git#mcp-gatewa
 nix profile install git+https://git.millerson.name/alex/millerson-overlay.nix.git#mcp-gateway
 ```
 
+### nftablesbuilder Runtime Notes
+
+`nftablesbuilder` is a web interface for managing nftables. It consists of a
+root-launcher (`nftablesbuilder`) that spawns the unprivileged `webserver`
+binary and pipes encrypted commands between it and the `nft` binary.
+
+Before running it you must:
+
+1. Copy the settings template to `/etc/nftablesbuilder` (the only fixed path):
+   ```bash
+   nix build .#nftablesbuilder
+   cp result/share/nftablesbuilder/settings.example /etc/nftablesbuilder
+   ```
+   Adjust paths inside (html, webserver, nft, savepath, TLS files).
+2. Create a TLS key/certificate pair at the paths referenced by
+   `tlskey`/`tlscert` (e.g. `openssl req -x509 -newkey rsa:2048 -nodes ...`).
+3. Run the launcher as root (it needs to write `/etc/nftables.conf` and run
+   `nft`); the web interface listens on `https://<server>:1969`.
+
+Note: upstream publishes the GUI only as a prebuilt tarball on
+nftablesbuilder.eu (served with a self-signed certificate, hence the
+`curlOpts = "-k"` in the derivation); the source repository is missing the
+`settings` crate, which this overlay patches in.
+
+
 ## Development
 
 ### Prerequisites

packages/nftablesbuilder/default.nix

@@ -0,0 +1,5 @@
+{
+  pkgs,
+  ...
+}:
+pkgs.callPackage ./package.nix { }

packages/nftablesbuilder/package.nix

@@ -0,0 +1,69 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  fetchurl,
+  pkg-config,
+  openssl,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "nftablesbuilder";
+  # Pinned to a commit rather than a release tag because upstream
+  # publishes releases only as tarballs on nftablesbuilder.eu.
+  version = "0.1.0-unstable-2026-01-27";
+
+  src = fetchFromGitHub {
+    owner = "AiseBouma";
+    repo = "NftablesBuilder";
+    rev = "f414e921c2857556cdb4d602ed832a32a6951d25";
+    hash = "sha256-5qwyVXLrUxOk7poVdUyi/yJUq1CYMffruvAO0ONO+cI=";
+  };
+
+  # Upstream source is incomplete: both crates depend on a `settings`
+  # crate (path = "../settings") that was never committed, and the GUI
+  # has no build tooling (raw TSX, no package.json). This patch adds
+  # the missing settings crate (schema recovered from the official
+  # release artifacts) plus a workspace Cargo.toml.
+  patches = [ ./settings-workspace.patch ];
+
+  cargoLock.lockFile = ./Cargo.lock;
+
+  # Prebuilt GUI from the official release tarball, since the GUI cannot
+  # be built from source. Upstream serves releases with a self-signed
+  # TLS certificate, hence curlOpts = "-k"; the hash still pins content.
+  guiSrc = fetchurl {
+    url = "https://nftablesbuilder.eu/releases/latest/nftablesbuilder.tar.gz";
+    sha256 = "sha256-vHyuKVH4OtXEisWeDo+b3gHg3TzdXUSfMbaNpfQOrns=";
+    curlOpts = "-k";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ openssl ];
+
+  installPhase = ''
+    runHook preInstall
+
+    binDir=$(dirname "$(find target -type f -name nftablesbuilder -path '*/release/*' | head -1)")
+    install -Dm755 $binDir/nftablesbuilder $out/bin/nftablesbuilder
+    install -Dm755 $binDir/webserver $out/libexec/nftablesbuilder/webserver
+
+    mkdir -p $out/share/nftablesbuilder
+    tar -xzf $guiSrc -C $out/share/nftablesbuilder --strip-components=4 nftablesbuilder/root/opt/nftablesbuilder/html
+    install -Dm644 ${./settings.example} $out/share/nftablesbuilder/settings.example
+
+    runHook postInstall
+  '';
+
+  passthru = {
+    category = "Networking";
+  };
+
+  meta = with lib; {
+    description = "Web interface to manage nftables rules";
+    homepage = "https://github.com/AiseBouma/NftablesBuilder";
+    license = licenses.mit;
+    mainProgram = "nftablesbuilder";
+    platforms = platforms.linux;
+  };
+}

packages/nftablesbuilder/settings.example

@@ -0,0 +1,17 @@
+[connection]
+port = 1969
+
+[paths]
+savepath = "/var/lib/nftablesbuilder"
+htmlpath = "/run/current-system/sw/share/nftablesbuilder/html"
+
+[files]
+nft = "/run/current-system/sw/bin/nft"
+test = "/tmp/nftables.conf"
+conf = "/etc/nftables.conf"
+webserver = "/run/current-system/sw/libexec/nftablesbuilder/webserver"
+tlskey = "/var/lib/nftablesbuilder/nftables.key"
+tlscert = "/var/lib/nftablesbuilder/nftables.crt"
+
+[commands]
+reload = "systemctl reload nftables"