From 562539936e761fa14d05db5bdbdd55c224fdfb21 Mon Sep 17 00:00:00 2001 From: "Reid \"reidlab" Date: Wed, 29 May 2024 00:13:12 -0700 Subject: [PATCH] mostly formatting --- README.md | 16 ++--- default.nix | 6 +- hosts/nixos-server-reid/hardware.nix | 2 +- lib/default.nix | 4 +- modules/security.nix | 92 ++++++++++++++-------------- modules/services/forgejo.nix | 2 +- 6 files changed, 61 insertions(+), 61 deletions(-) diff --git a/README.md b/README.md index f9464ed..3f6c21e 100755 --- a/README.md +++ b/README.md @@ -7,11 +7,11 @@ nix flake config! this is just used on my personal server at the moment this flake is built for a multi-user experience per host, enforced by [`modules/users.nix`](./modules/users.nix), and found in the `default.nix` file for each host. ## todo - -- remove the lua static stuff from nginx + maybe cloudflare ips too + redis -- per-host architecture selection, atm it is hardcoded to `aarch64` -- some weird perl error abt locales when building using doas - `keepEnv` might fix this -- move common config such as bootloader and networking settings to [`default.nix`](./default.nix) -- swap back to hardened kernel -- leverage nixos-hardware -- unscuff metrics + - remove the lua static stuff from nginx + maybe cloudflare ips too + redis + - per-host architecture selection, atm it is hardcoded to `aarch64` + - some weird perl error abt locales when building using doas - `keepEnv` might fix this + - move common config such as bootloader and networking settings to [`default.nix`](./default.nix) + - swap back to hardened kernel + - leverage nixos-hardware + - unscuff metrics + - wtaf is going on w/ our user management?? \ No newline at end of file diff --git a/default.nix b/default.nix index 79c1614..05276e3 100755 --- a/default.nix +++ b/default.nix @@ -19,7 +19,7 @@ in { nixPath = [ "nixpkgs=${inputs.nixpkgs}" ]; registry.nixpkgs.flake = inputs.nixpkgs; - settings = { + settings = { experimental-features = [ "nix-command" "flakes" ]; auto-optimise-store = true; keep-outputs = true; @@ -28,9 +28,9 @@ in { "https://nix-community.cachix.org" ]; trusted-public-keys = [ - "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" + "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" ]; - }; + }; }; # set our git revision inside `nixos-version` diff --git a/hosts/nixos-server-reid/hardware.nix b/hosts/nixos-server-reid/hardware.nix index 83a985a..4363bbc 100755 --- a/hosts/nixos-server-reid/hardware.nix +++ b/hosts/nixos-server-reid/hardware.nix @@ -21,7 +21,7 @@ }; fileSystems."/" = { - device = "/dev/disk/by-uuid/44444444-4444-4444-8888-888888888888"; + device = "/dev/disk/by-uuid/44444444-4444-4444-8888-888888888888"; fsType = "ext4"; }; diff --git a/lib/default.nix b/lib/default.nix index 1bb3d04..dfd2478 100755 --- a/lib/default.nix +++ b/lib/default.nix @@ -9,8 +9,8 @@ modules = import ./modules.nix { inherit lib; self.attrs = import ./attrs.nix { - inherit lib; - self = {}; + inherit lib; + self = {}; }; }; mylib = diff --git a/modules/security.nix b/modules/security.nix index 1fdc7bc..408d171 100755 --- a/modules/security.nix +++ b/modules/security.nix @@ -13,55 +13,55 @@ in { tmp.useTmpfs = lib.mkDefault true; tmp.cleanOnBoot = lib.mkDefault (!config.boot.tmp.useTmpfs); - kernel.sysctl = { - # magic sysrq key, allows low-level commands through keyboard input - "kernel.sysrq" = 0; + kernel.sysctl = { + # magic sysrq key, allows low-level commands through keyboard input + "kernel.sysrq" = 0; - ## TCP hardening - # prevent bogus ICMP errors from filling up logs - "net.ipv4.icmp_ignore_bogus_error_responses" = 1; - # do not accept IP source packets (we are not a router) - "net.ipv4.conf.all.accept_source_route" = 0; - "net.ipv6.conf.all.accept_source_route" = 0; - # don't send ICMP redirects (again, we're not a router) - "net.ipv4.conf.all.send_redirects" = 0; - "net.ipv4.conf.default.send_redirects" = 0; - # refuse ICMP redirects (MITM mitigations) - "net.ipv4.conf.all.accept_redirects" = 0; - "net.ipv4.conf.default.accept_redirects" = 0; - "net.ipv4.conf.all.secure_redirects" = 0; - "net.ipv4.conf.default.secure_redirects" = 0; - "net.ipv6.conf.all.accept_redirects" = 0; - "net.ipv6.conf.default.accept_redirects" = 0; - # protects against SYN flood attacks - "net.ipv4.tcp_syncookies" = 1; - # incomplete protection against TIME-WAIT assassination - "net.ipv4.tcp_rfc1337" = 1; + ## TCP hardening + # prevent bogus ICMP errors from filling up logs + "net.ipv4.icmp_ignore_bogus_error_responses" = 1; + # do not accept IP source packets (we are not a router) + "net.ipv4.conf.all.accept_source_route" = 0; + "net.ipv6.conf.all.accept_source_route" = 0; + # don't send ICMP redirects (again, we're not a router) + "net.ipv4.conf.all.send_redirects" = 0; + "net.ipv4.conf.default.send_redirects" = 0; + # refuse ICMP redirects (MITM mitigations) + "net.ipv4.conf.all.accept_redirects" = 0; + "net.ipv4.conf.default.accept_redirects" = 0; + "net.ipv4.conf.all.secure_redirects" = 0; + "net.ipv4.conf.default.secure_redirects" = 0; + "net.ipv6.conf.all.accept_redirects" = 0; + "net.ipv6.conf.default.accept_redirects" = 0; + # protects against SYN flood attacks + "net.ipv4.tcp_syncookies" = 1; + # incomplete protection against TIME-WAIT assassination + "net.ipv4.tcp_rfc1337" = 1; - ## TCP optimization - # TCP fastopen - "net.ipv4.tcp_fastopen" = 3; - # bufferbloat mitigations + improvement in throughput and latency - "net.ipv4.tcp_conjestion_control" = "bbr"; - "net.core.default_qdisc" = "cake"; - }; - kernelModules = [ "tcp_bbr" ]; + ## TCP optimization + # TCP fastopen + "net.ipv4.tcp_fastopen" = 3; + # bufferbloat mitigations + improvement in throughput and latency + "net.ipv4.tcp_conjestion_control" = "bbr"; + "net.core.default_qdisc" = "cake"; }; + kernelModules = [ "tcp_bbr" ]; + }; - security = { - # prevents replacing the kernel without a reboot - protectKernelImage = true; - # rtkit allows unprivileged processes to use realtime scheduling - # polkit allows unprivileged processes to speak to privileged processes (ex. nmtui, reboot) - rtkit.enable = true; - polkit.enable = true; - }; + security = { + # prevents replacing the kernel without a reboot + protectKernelImage = true; + # rtkit allows unprivileged processes to use realtime scheduling + # polkit allows unprivileged processes to speak to privileged processes (ex. nmtui, reboot) + rtkit.enable = true; + polkit.enable = true; + }; - # while this is on by default, i am going to explicitly specify this - networking.firewall.enable = true; - } // (mkIf cfg.useDoas { - security.sudo.enable = false; - security.doas.enable = true; - environment.systemPackages = with pkgs; [ doas-sudo-shim ]; - }); + # while this is on by default, i am going to explicitly specify this + networking.firewall.enable = true; + } // (mkIf cfg.useDoas { + security.sudo.enable = false; + security.doas.enable = true; + environment.systemPackages = with pkgs; [ doas-sudo-shim ]; + }); } diff --git a/modules/services/forgejo.nix b/modules/services/forgejo.nix index 73b3e31..0c99b68 100755 --- a/modules/services/forgejo.nix +++ b/modules/services/forgejo.nix @@ -30,7 +30,7 @@ in { database.type = "postgres"; settings = { "DEFAULT" = { - APP_NAME = "reidlab's git instance"; + APP_NAME = "reidlab's git instance"; }; "security" = { INSTALL_LOCK = true;