unexplrd/nixos-blueprint
2
2
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

move around security

Browse Source 
Signed-off-by: unexplrd <unexplrd@linerds.us>
This commit is contained in:
unexplrd
2025-05-04 19:31:59 +03:00
parent 9510cc48e2
commit 4652ce19db
19 changed files with 103 additions and 308 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
modules/nixos/config/boot/default.nix
View File

@ -1,5 +1,4 @@
{
config,
inputs,
pkgs,
...
@ -13,21 +12,6 @@
plymouth.enable = true;
consoleLogLevel = 0;
kernelPackages = pkgs.linuxPackages_cachyos;
kernelParams = [
"amd_iommu=force_isolation"
"debugfs=off"
"efi=disable_early_pci_dma"
"gather_data_sampling=force"
"intel_iommu=on"
"iommu.passthrough=0"
"iommu.strict=1"
"iommu=force"
"page_alloc.shuffle=1"
"vsyscall=none"
# "ia32_emulation=0"
# "lockdown=confidentiality"
# "module.sig_enforce=1"
];
initrd = {
systemd.enable = true;
systemd.tpm2.enable = false;

1
modules/nixos/config/default.nix
View File

@ -13,6 +13,7 @@ in {
./hardware
./networking
./nix
./security
./programs.nix
./services.nix
./users.nix

1
modules/nixos/config/nix/default.nix
View File

@ -2,6 +2,5 @@
imports = [
./common.nix
./substituters.nix
# ./ssh-serve.nix
];
}

30
modules/nixos/config/nix/distributed-build.nix
View File

@ -1,30 +0,0 @@
{
config,
inputs,
...
}: let
inherit (builtins) readFile;
inherit (config.networking) hostName;
inherit (config.sops) secrets;
inherit (inputs) mysecrets;
pubHost = readFile "${mysecrets}/ssh/ssh_host_ed25519_dunamis.base64";
in {
nix = {
distributedBuilds = true;
buildMachines = [
{
hostName = "dunamis";
publicHostKey = pubHost;
sshKey = secrets."ssh-${hostName}-user".path;
sshUser = "nix-ssh";
supportedFeatures = [
"benchmark"
"big-parallel"
"kvm"
"nixos-test"
];
system = "x86_64-linux";
}
];
};
}

11
modules/nixos/config/nix/ssh-serve.nix
View File

@ -1,11 +0,0 @@
{config, ...}: let
inherit (builtins) readFile;
inherit (config.users.users) user;
in {
nix.settings.trusted-users = ["nix-ssh"];
nix.sshServe = {
enable = true;
write = true;
keys = map (f: readFile f) user.openssh.authorizedKeys.keyFiles;
};
}

99
modules/nixos/config/security/default.nix Normal file
View File

@ -0,0 +1,99 @@
{
config,
lib,
pkgs,
...
}: let
inherit (lib) mkIf mkDefault;
in {
security = {
sudo.enable = false;
# doas.enable = true;
sudo-rs = {
enable = true;
execWheelOnly = true;
};
polkit.enable = true;
polkit.extraConfig = ''
polkit.addRule(function(action, subject) {
if (
subject.isInGroup("users")
&& (
action.id == "org.freedesktop.login1.reboot" ||
action.id == "org.freedesktop.login1.reboot-multiple-sessions" ||
action.id == "org.freedesktop.login1.power-off" ||
action.id == "org.freedesktop.login1.power-off-multiple-sessions"
)
)
{
return polkit.Result.YES;
}
});
'';
apparmor.enable = mkDefault true;
};
environment.systemPackages = with pkgs; [
(mkIf config.security.doas.enable doas-sudo-shim) # if doas install doas sudo shim
];
services.dbus = {
apparmor = "enabled";
implementation = "broker";
};
services.ntpd-rs = {
enable = true;
#settings = {
# server = {
# require-nts = true;
# };
#};
};
boot.kernelParams = [
"amd_iommu=force_isolation"
"debugfs=off"
"efi=disable_early_pci_dma"
"gather_data_sampling=force"
"intel_iommu=on"
"iommu.passthrough=0"
"iommu.strict=1"
"iommu=force"
"page_alloc.shuffle=1"
"vsyscall=none"
# "ia32_emulation=0"
# "lockdown=confidentiality"
# "module.sig_enforce=1"
];
boot.blacklistedKernelModules = [
# Obscure network protocols
"ax25"
"netrom"
"rose"
# Old or rare or insufficiently audited filesystems
"adfs"
"affs"
"bfs"
"befs"
"cramfs"
"efs"
"erofs"
"exofs"
"freevxfs"
"f2fs"
"hfs"
"hpfs"
"jfs"
"minix"
"nilfs2"
"ntfs"
"omfs"
"qnx4"
"qnx6"
"sysv"
"ufs"
];
nix.settings.allowed-users = mkDefault ["@users"];
}