reidlab/nix-server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

bro

Browse source
This commit is contained in:
Reid 2026-04-01 22:24:48 -07:00
parent 90572a1ff0
commit 4304b5c887
Signed by: reidlab
GPG key ID: DAF5EAF6665839FD
2 changed files with 61 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

2
default.nix
View file

@ -18,7 +18,7 @@ in {
boot = { boot = {
kernelPackages = mkDefault pkgs.linuxPackages_latest; kernelPackages = mkDefault pkgs.linuxPackages_latest;
kernelParams = [ "pci_aspm.policy=performance" ]; kernelParams = [ "pcie_aspm.policy=performance" ];
}; };
time.timeZone = mkDefault "America/Los_Angeles"; time.timeZone = mkDefault "America/Los_Angeles";

17
modules/security.nix
View file

@ -8,11 +8,15 @@ in {
useDoas = mkEnableOption "use opendoas instead of sudo"; useDoas = mkEnableOption "use opendoas instead of sudo";
}; };
config = mkIf cfg.enable { config = mkMerge [
{
boot = { boot = {
tmp.useTmpfs = lib.mkDefault true; tmp.useTmpfs = lib.mkDefault true;
tmp.cleanOnBoot = lib.mkDefault (!config.boot.tmp.useTmpfs); tmp.cleanOnBoot = lib.mkDefault (!config.boot.tmp.useTmpfs);
# disable kernel parameter editing on boot
loader.systemd-boot.editor = false;
kernel.sysctl = { kernel.sysctl = {
# magic sysrq key, allows low-level commands through keyboard input # magic sysrq key, allows low-level commands through keyboard input
"kernel.sysrq" = 0; "kernel.sysrq" = 0;
@ -42,7 +46,7 @@ in {
# TCP fastopen # TCP fastopen
"net.ipv4.tcp_fastopen" = 3; "net.ipv4.tcp_fastopen" = 3;
# bufferbloat mitigations + improvement in throughput and latency # bufferbloat mitigations + improvement in throughput and latency
"net.ipv4.tcp_conjestion_control" = "bbr"; "net.ipv4.tcp_congestion_control" = "bbr";
"net.core.default_qdisc" = "cake"; "net.core.default_qdisc" = "cake";
}; };
kernelModules = [ "tcp_bbr" ]; kernelModules = [ "tcp_bbr" ];
@ -61,9 +65,14 @@ in {
networking.firewall.enable = true; networking.firewall.enable = true;
services.fwupd.enable = true; services.fwupd.enable = true;
} // (mkIf cfg.useDoas { }
(mkIf cfg.useDoas {
security.sudo.enable = false; security.sudo.enable = false;
security.doas.enable = true; security.doas.enable = true;
security.doas.extraRules = [
{ users = [ config.user.name ]; noPass = true; persist = false; keepEnv = true; }
];
environment.systemPackages = with pkgs; [ doas-sudo-shim ]; environment.systemPackages = with pkgs; [ doas-sudo-shim ];
}); })
];
} }