nixos: profiles: core: sorting

This commit is contained in:
Guanran Wang 2023-12-16 16:58:10 +08:00
parent f8f66a088f
commit a35a190d7c
Signed by: nyancat
SSH key fingerprint: SHA256:8oWGKciPALWut/6WA27oFKofX+6Wtc0gQnsefXLQx/8
4 changed files with 105 additions and 131 deletions

View file

@ -5,9 +5,9 @@
...
}: {
imports = [
./hardening
./nix
./packages
./sysctl.nix
# Flake modules
inputs.self.nixosModules.default
@ -18,46 +18,40 @@
inputs.sops-nix.nixosModules.sops
];
# Flake overlays
nixpkgs.overlays = [
inputs.berberman.overlays.default
];
users.mutableUsers = false;
home-manager = {
useGlobalPkgs = true;
useUserPackages = true;
extraSpecialArgs = {inherit inputs;}; # ??? isnt specialArgs imported by default ???
};
### Boot
boot.initrd.systemd.enable = true;
boot.loader = {
efi.canTouchEfiVariables = true;
systemd-boot = {
boot.loader.efi.canTouchEfiVariables = true;
boot.loader.systemd-boot = {
enable = lib.mkDefault true; # mkDefault for Lanzaboote
editor = false; # Disabled for security
### Utilities
#netbootxyz.enable = true;
#memtest86.enable = true;
};
};
users.mutableUsers = false;
# Programs
### Default Programs
environment.defaultPackages = [];
programs = {
dconf.enable = true;
nano.enable = false; # make sure to add another editor and set the $EDITOR variable, in this case I am using neovim
neovim = {
programs.dconf.enable = true;
programs.nano.enable = false; # make sure to add another editor and set the $EDITOR variable
programs.neovim = {
enable = true;
viAlias = true;
vimAlias = true;
defaultEditor = true;
};
services.openssh = {
enable = true;
settings.PermitRootLogin = "no";
settings.PasswordAuthentication = false;
};
# WORKAROUND: Revert to NVIDIA version 470.223.02 due to performance issues in version 545.29.06,
# this shouldn't affect non-nvidia machines.
nixpkgs.config.nvidia.acceptLicense = true;
hardware.nvidia.package = config.boot.kernelPackages.nvidiaPackages.legacy_470;
# Services
services = {
getty.greetingLine = let
services.getty.greetingLine = let
inherit (config.system) nixos;
in ''
NixOS ${nixos.label} ${nixos.codeName} (\m) - \l
@ -67,75 +61,22 @@
"[ 5.996722] amdgpu 0000:67:00.0: Fatal error during GPU init"}
'';
openssh = {
enable = true;
settings = {
PermitRootLogin = "no";
PasswordAuthentication = false;
### WORKAROUND: Revert to NVIDIA version 470.223.02 due to performance issues in version 545.29.06,
# this shouldn't affect non-nvidia machines.
nixpkgs.config.nvidia.acceptLicense = true;
hardware.nvidia.package = config.boot.kernelPackages.nvidiaPackages.legacy_470;
### https://wiki.archlinux.org/title/Sysctl#Improving_performance
boot.kernelModules = ["tcp_bbr"];
boot.kernel.sysctl = {
"net.ipv4.tcp_fastopen" = "3";
"net.ipv4.tcp_keepalive_time" = "80";
"net.ipv4.tcp_keepalive_intvl" = "10";
"net.ipv4.tcp_keepalive_probes" = "6";
"net.ipv4.tcp_mtu_probing" = "1";
"net.core.default_qdisc" = "cake";
"net.ipv4.tcp_congestion_control" = "bbr";
};
};
#cron.enable = true;
#dbus.enable = true;
# BTRFS De-Dupe
# bruh how to make it not a background job
# i want to run it manually
#beesd.filesystems = {
# root = {
# spec = "UUID=3e10ff73-e1f7-4b39-88f5-7f31dcc8f38c";
# hashTableSizeMB = 2048;
# verbosity = "crit";
# #extraOptions = [ "--loadavg-target" "5.0" ];
# };
#};
};
home-manager = {
useGlobalPkgs = true;
useUserPackages = true;
extraSpecialArgs = {inherit inputs;}; # ??? isnt specialArgs imported by default ???
};
### Basic hardening
# ref: https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/profiles/hardened.nix
# ref: https://madaidans-insecurities.github.io/guides/linux-hardening.html
#
# also see: ./sysctl.nix
environment.etc.machine-id.text = "b08dfa6083e7567a1921a715000001fb"; # whonix id
security = {
apparmor.enable = true;
sudo.execWheelOnly = true;
};
boot.blacklistedKernelModules = [
# Obscure network protocols
"ax25"
"netrom"
"rose"
# Old or rare or insufficiently audited filesystems
"adfs"
"affs"
"bfs"
"befs"
"cramfs"
"efs"
"erofs"
"exofs"
"freevxfs"
"f2fs"
"hfs"
"hpfs"
"jfs"
"minix"
"nilfs2"
"ntfs"
"omfs"
"qnx4"
"qnx6"
"sysv"
"ufs"
];
}

View file

@ -0,0 +1,39 @@
_: {
### Basic hardening
# ref: https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/profiles/hardened.nix
# ref: https://madaidans-insecurities.github.io/guides/linux-hardening.html
environment.etc.machine-id.text = "b08dfa6083e7567a1921a715000001fb"; # whonix id
security.apparmor.enable = true;
security.sudo.execWheelOnly = true;
boot.blacklistedKernelModules = [
# Obscure network protocols
"ax25"
"netrom"
"rose"
# Old or rare or insufficiently audited filesystems
"adfs"
"affs"
"bfs"
"befs"
"cramfs"
"efs"
"erofs"
"exofs"
"freevxfs"
"f2fs"
"hfs"
"hpfs"
"jfs"
"minix"
"nilfs2"
"ntfs"
"omfs"
"qnx4"
"qnx6"
"sysv"
"ufs"
];
}

View file

@ -1,5 +1,4 @@
_: {
boot.kernelModules = ["tcp_bbr"];
boot.kernel.sysctl = {
### https://madaidans-insecurities.github.io/guides/linux-hardening.html#sysctl
# Kernel self-protection
@ -47,16 +46,5 @@ _: {
"fs.protected_hardlinks" = "1";
"fs.protected_fifos" = "2";
"fs.protected_regular" = "2";
### https://wiki.archlinux.org/title/Sysctl#Improving_performance
"net.ipv4.tcp_fastopen" = "3";
"net.ipv4.tcp_keepalive_time" = "80";
"net.ipv4.tcp_keepalive_intvl" = "10";
"net.ipv4.tcp_keepalive_probes" = "6";
"net.ipv4.tcp_mtu_probing" = "1";
"net.core.default_qdisc" = "cake";
"net.ipv4.tcp_congestion_control" = "bbr";
};
}

View file

@ -1,13 +1,19 @@
{pkgs, ...}: {
{
pkgs,
inputs,
...
}: {
i18n.inputMethod = {
enabled = "fcitx5";
fcitx5.addons = with pkgs; [
fcitx5.addons =
(with pkgs; [
fcitx5-chinese-addons
fcitx5-pinyin-moegirl # Using Berberman's Flake overlay
fcitx5-pinyin-zhwiki
#fcitx5-rime
];
])
++ (with inputs.berberman.packages.${pkgs.system}; [
fcitx5-pinyin-moegirl
fcitx5-pinyin-zhwiki
]);
};
home.sessionVariables = {