From 77bec9fce38ab04a1bd2d147119eb28ffc466d44 Mon Sep 17 00:00:00 2001
From: Mark Nipper <nipsy@bitgnome.net>
Date: Mon, 27 Jul 2026 11:44:45 -0700
Subject: Add games-fw helper

---
 home/root/arrakis.nix | 62 +++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 62 insertions(+)

diff --git a/home/root/arrakis.nix b/home/root/arrakis.nix
index d9d9162..7712609 100644
--- a/home/root/arrakis.nix
+++ b/home/root/arrakis.nix
@@ -5,7 +5,69 @@
   ];
 
   home.file = {
+    "bin/games-fw" = {
+      executable = true;
+      text = ''
+        #!${pkgs.zsh}/bin/zsh
+
+        # load module to parse command line arguments
+        zmodload zsh/zutil
+        zparseopts -D -E -A opts -- d h l x
+        
+        # enable XTRACE shell option for full debugging output of scripts
+        if (( ${+opts[-x]} )); then
+        	set -x
+        fi
+        
+        if ! (( ${+opts[-l]} )) && [[ -z "${1}" ]] || (( ${+opts[-h]} )); then
+        	echo "usage: ${0:t} [ -h ] [ -x ] { -d handle | -l | cidr }" >&2
+        	echo '
+        	-d	delete a rule by handle; handle must be specified ( nft -a list ruleset )
+        	-h	this message
+        	-l	list games chain
+        	-x	enable shell debugging
+        	cidr	IPv4 host or CIDR network address
+        ' >&2
+        	exit 1
+        fi
+        
+        function list_games_chain {
+        	nft -a list ruleset | sed -ne '/\tchain games {/,/\t}$/p'
+        }
+        
+        if (( ${+opts[-d]} )); then
+        
+        	handle="${1}"
+        	rule=$(nft -a list ruleset | grep ' # handle '"${handle}"'$')
+        
+        	if [[ -z "${rule}" ]]; then
+        		echo 'no matching handle found!' >&2
+        		exit 1
+        	else
+        
+        		nft delete rule inet nixos-fw games handle ${handle}
+        		list_games_chain
+        
+        	fi
+        
+        elif (( ${+opts[-l]} )); then
+        
+        	list_games_chain
+        
+        else
+        
+        	cidr="${1}"
+        	nft insert rule inet nixos-fw games 'ip saddr '"${cidr}"' counter accept'
+        	list_games_chain
+        
+        fi
+        
+        exit 0
+      ''
+    };
+
     "bin/knock".source = ../common/scripts/knock;
+
     "bin/vpnctl" = {
       executable = true;
       text = ''
-- 
cgit v1.3.1