nixos: profiles: core: sorting

nixos/profiles/core/default.nix

@@ -5,9 +5,9 @@
   ...
 }: {
   imports = [
+    ./hardening
     ./nix
     ./packages
-    ./sysctl.nix
 
     # Flake modules
     inputs.self.nixosModules.default
@@ -18,124 +18,65 @@
     inputs.sops-nix.nixosModules.sops
   ];
 
-  # Flake overlays
-  nixpkgs.overlays = [
-    inputs.berberman.overlays.default
-  ];
-
-  boot.initrd.systemd.enable = true;
-  boot.loader = {
-    efi.canTouchEfiVariables = true;
-    systemd-boot = {
-      enable = lib.mkDefault true; # mkDefault for Lanzaboote
-      editor = false; # Disabled for security
-      ### Utilities
-      #netbootxyz.enable = true;
-      #memtest86.enable = true;
-    };
-  };
-
   users.mutableUsers = false;
-
-  # Programs
-  environment.defaultPackages = [];
-  programs = {
-    dconf.enable = true;
-    nano.enable = false; # make sure to add another editor and set the $EDITOR variable, in this case I am using neovim
-    neovim = {
-      enable = true;
-      viAlias = true;
-      vimAlias = true;
-      defaultEditor = true;
-    };
-  };
-
-  # WORKAROUND: Revert to NVIDIA version 470.223.02 due to performance issues in version 545.29.06,
-  #             this shouldn't affect non-nvidia machines.
-  nixpkgs.config.nvidia.acceptLicense = true;
-  hardware.nvidia.package = config.boot.kernelPackages.nvidiaPackages.legacy_470;
-
-  # Services
-  services = {
-    getty.greetingLine = let
-      inherit (config.system) nixos;
-    in ''
-      NixOS ${nixos.label} ${nixos.codeName} (\m) - \l
-      ${lib.strings.optionalString (builtins.elem "nvidia" config.services.xserver.videoDrivers)
-        "--my-next-gpu-wont-be-nvidia"}
-      ${lib.strings.optionalString (builtins.elem "amdgpu" config.boot.initrd.kernelModules)
-        "[    5.996722] amdgpu 0000:67:00.0: Fatal error during GPU init"}
-    '';
-
-    openssh = {
-      enable = true;
-      settings = {
-        PermitRootLogin = "no";
-        PasswordAuthentication = false;
-      };
-    };
-
-    #cron.enable = true;
-    #dbus.enable = true;
-
-    # BTRFS De-Dupe
-    # bruh how to make it not a background job
-    # i want to run it manually
-    #beesd.filesystems = {
-    #  root = {
-    #    spec = "UUID=3e10ff73-e1f7-4b39-88f5-7f31dcc8f38c";
-    #    hashTableSizeMB = 2048;
-    #    verbosity = "crit";
-    #    #extraOptions = [ "--loadavg-target" "5.0" ];
-    #  };
-    #};
-  };
-
   home-manager = {
     useGlobalPkgs = true;
     useUserPackages = true;
     extraSpecialArgs = {inherit inputs;}; # ??? isnt specialArgs imported by default ???
   };
 
-  ### Basic hardening
+  ### Boot
-  # ref: https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/profiles/hardened.nix
+  boot.initrd.systemd.enable = true;
-  # ref: https://madaidans-insecurities.github.io/guides/linux-hardening.html
+  boot.loader.efi.canTouchEfiVariables = true;
-  #
+  boot.loader.systemd-boot = {
-  # also see: ./sysctl.nix
+    enable = lib.mkDefault true; # mkDefault for Lanzaboote
-
+    editor = false; # Disabled for security
-  environment.etc.machine-id.text = "b08dfa6083e7567a1921a715000001fb"; # whonix id
+    ### Utilities
-  security = {
+    #netbootxyz.enable = true;
-    apparmor.enable = true;
+    #memtest86.enable = true;
-    sudo.execWheelOnly = true;
   };
 
-  boot.blacklistedKernelModules = [
+  ### Default Programs
-    # Obscure network protocols
+  environment.defaultPackages = [];
-    "ax25"
+  programs.dconf.enable = true;
-    "netrom"
+  programs.nano.enable = false; # make sure to add another editor and set the $EDITOR variable
-    "rose"
+  programs.neovim = {
+    enable = true;
+    viAlias = true;
+    vimAlias = true;
+    defaultEditor = true;
+  };
+  services.openssh = {
+    enable = true;
+    settings.PermitRootLogin = "no";
+    settings.PasswordAuthentication = false;
+  };
+  services.getty.greetingLine = let
+    inherit (config.system) nixos;
+  in ''
+    NixOS ${nixos.label} ${nixos.codeName} (\m) - \l
+    ${lib.strings.optionalString (builtins.elem "nvidia" config.services.xserver.videoDrivers)
+      "--my-next-gpu-wont-be-nvidia"}
+    ${lib.strings.optionalString (builtins.elem "amdgpu" config.boot.initrd.kernelModules)
+      "[    5.996722] amdgpu 0000:67:00.0: Fatal error during GPU init"}
+  '';
 
-    # Old or rare or insufficiently audited filesystems
+  ### WORKAROUND: Revert to NVIDIA version 470.223.02 due to performance issues in version 545.29.06,
-    "adfs"
+  #               this shouldn't affect non-nvidia machines.
-    "affs"
+  nixpkgs.config.nvidia.acceptLicense = true;
-    "bfs"
+  hardware.nvidia.package = config.boot.kernelPackages.nvidiaPackages.legacy_470;
-    "befs"
+
-    "cramfs"
+  ### https://wiki.archlinux.org/title/Sysctl#Improving_performance
-    "efs"
+  boot.kernelModules = ["tcp_bbr"];
-    "erofs"
+  boot.kernel.sysctl = {
-    "exofs"
+    "net.ipv4.tcp_fastopen" = "3";
-    "freevxfs"
+
-    "f2fs"
+    "net.ipv4.tcp_keepalive_time" = "80";
-    "hfs"
+    "net.ipv4.tcp_keepalive_intvl" = "10";
-    "hpfs"
+    "net.ipv4.tcp_keepalive_probes" = "6";
-    "jfs"
+    "net.ipv4.tcp_mtu_probing" = "1";
-    "minix"
+
-    "nilfs2"
+    "net.core.default_qdisc" = "cake";
-    "ntfs"
+    "net.ipv4.tcp_congestion_control" = "bbr";
-    "omfs"
+  };
-    "qnx4"
-    "qnx6"
-    "sysv"
-    "ufs"
-  ];
 }

nixos/profiles/core/hardening/default.nix

@@ -0,0 +1,39 @@
+_: {
+  ### Basic hardening
+  # ref: https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/profiles/hardened.nix
+  # ref: https://madaidans-insecurities.github.io/guides/linux-hardening.html
+
+  environment.etc.machine-id.text = "b08dfa6083e7567a1921a715000001fb"; # whonix id
+  security.apparmor.enable = true;
+  security.sudo.execWheelOnly = true;
+
+  boot.blacklistedKernelModules = [
+    # Obscure network protocols
+    "ax25"
+    "netrom"
+    "rose"
+
+    # Old or rare or insufficiently audited filesystems
+    "adfs"
+    "affs"
+    "bfs"
+    "befs"
+    "cramfs"
+    "efs"
+    "erofs"
+    "exofs"
+    "freevxfs"
+    "f2fs"
+    "hfs"
+    "hpfs"
+    "jfs"
+    "minix"
+    "nilfs2"
+    "ntfs"
+    "omfs"
+    "qnx4"
+    "qnx6"
+    "sysv"
+    "ufs"
+  ];
+}

nixos/profiles/core/hardening/sysctl.nix

@@ -1,5 +1,4 @@
 _: {
-  boot.kernelModules = ["tcp_bbr"];
   boot.kernel.sysctl = {
     ### https://madaidans-insecurities.github.io/guides/linux-hardening.html#sysctl
     # Kernel self-protection
@@ -47,16 +46,5 @@ _: {
     "fs.protected_hardlinks" = "1";
     "fs.protected_fifos" = "2";
     "fs.protected_regular" = "2";
-
-    ### https://wiki.archlinux.org/title/Sysctl#Improving_performance
-    "net.ipv4.tcp_fastopen" = "3";
-
-    "net.ipv4.tcp_keepalive_time" = "80";
-    "net.ipv4.tcp_keepalive_intvl" = "10";
-    "net.ipv4.tcp_keepalive_probes" = "6";
-    "net.ipv4.tcp_mtu_probing" = "1";
-
-    "net.core.default_qdisc" = "cake";
-    "net.ipv4.tcp_congestion_control" = "bbr";
   };
 }

users/guanranwang/home-manager/applications/fcitx5/default.nix

@@ -1,13 +1,19 @@
-{pkgs, ...}: {
+{
+  pkgs,
+  inputs,
+  ...
+}: {
   i18n.inputMethod = {
     enabled = "fcitx5";
-    fcitx5.addons = with pkgs; [
+    fcitx5.addons =
-      fcitx5-chinese-addons
+      (with pkgs; [
-      fcitx5-pinyin-moegirl # Using Berberman's Flake overlay
+        fcitx5-chinese-addons
-      fcitx5-pinyin-zhwiki
+        #fcitx5-rime
-
+      ])
-      #fcitx5-rime
+      ++ (with inputs.berberman.packages.${pkgs.system}; [
-    ];
+        fcitx5-pinyin-moegirl
+        fcitx5-pinyin-zhwiki
+      ]);
   };
 
   home.sessionVariables = {