Add git, neofetch, replace iptables with nftables, setup /etc/sysctl.conf

board/mentalnet/overlay/etc/nftables.conf

@@ -0,0 +1,41 @@
+# /etc/nftables.conf - Mentalnet GNU/Linux firewall
+# Loaded by /etc/init.d/S35nftables at boot. Edit and re-run:
+#   nft -f /etc/nftables.conf
+
+flush ruleset
+
+table inet filter {
+	chain input {
+		type filter hook input priority 0; policy drop;
+
+		# loopback
+		iifname "lo" accept
+
+		# established and related connections
+		ct state established,related accept
+
+		# DHCP client replies
+		udp sport 67 udp dport 68 accept
+
+		# ICMP (ping et al.)
+		ip protocol icmp accept
+		ip6 nexthdr icmpv6 accept
+
+		# services: SSH, HTTP
+		tcp dport 22 accept
+		tcp dport 80 accept
+
+		# log and reject everything else (rate-limited: goes to
+		# syslog, not the TTY - see /etc/sysctl.conf)
+		limit rate 1/minute log prefix "nft-drop: " counter
+		counter reject with icmpx type port-unreachable
+	}
+
+	chain forward {
+		type filter hook forward priority 0; policy accept;
+	}
+
+	chain output {
+		type filter hook output priority 0; policy accept;
+	}
+}