move around security

Signed-off-by: unexplrd <unexplrd@linerds.us>

modules/nixos/config/security/default.nix

@@ -0,0 +1,99 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  inherit (lib) mkIf mkDefault;
+in {
+  security = {
+    sudo.enable = false;
+    # doas.enable = true;
+    sudo-rs = {
+      enable = true;
+      execWheelOnly = true;
+    };
+    polkit.enable = true;
+    polkit.extraConfig = ''
+      polkit.addRule(function(action, subject) {
+        if (
+          subject.isInGroup("users")
+            && (
+              action.id == "org.freedesktop.login1.reboot" ||
+              action.id == "org.freedesktop.login1.reboot-multiple-sessions" ||
+              action.id == "org.freedesktop.login1.power-off" ||
+              action.id == "org.freedesktop.login1.power-off-multiple-sessions"
+            )
+          )
+        {
+          return polkit.Result.YES;
+        }
+      });
+    '';
+    apparmor.enable = mkDefault true;
+  };
+
+  environment.systemPackages = with pkgs; [
+    (mkIf config.security.doas.enable doas-sudo-shim) # if doas install doas sudo shim
+  ];
+
+  services.dbus = {
+    apparmor = "enabled";
+    implementation = "broker";
+  };
+  services.ntpd-rs = {
+    enable = true;
+    #settings = {
+    #  server = {
+    #    require-nts = true;
+    #  };
+    #};
+  };
+
+  boot.kernelParams = [
+    "amd_iommu=force_isolation"
+    "debugfs=off"
+    "efi=disable_early_pci_dma"
+    "gather_data_sampling=force"
+    "intel_iommu=on"
+    "iommu.passthrough=0"
+    "iommu.strict=1"
+    "iommu=force"
+    "page_alloc.shuffle=1"
+    "vsyscall=none"
+    # "ia32_emulation=0"
+    # "lockdown=confidentiality"
+    # "module.sig_enforce=1"
+  ];
+
+  boot.blacklistedKernelModules = [
+    # Obscure network protocols
+    "ax25"
+    "netrom"
+    "rose"
+    # Old or rare or insufficiently audited filesystems
+    "adfs"
+    "affs"
+    "bfs"
+    "befs"
+    "cramfs"
+    "efs"
+    "erofs"
+    "exofs"
+    "freevxfs"
+    "f2fs"
+    "hfs"
+    "hpfs"
+    "jfs"
+    "minix"
+    "nilfs2"
+    "ntfs"
+    "omfs"
+    "qnx4"
+    "qnx6"
+    "sysv"
+    "ufs"
+  ];
+
+  nix.settings.allowed-users = mkDefault ["@users"];
+}