changed some module stuf

default.nix

@@ -7,13 +7,32 @@ in {
     [ inputs.home-manager.nixosModules.home-manager ]
     ++ _.mapModulesRec' ./modules import;
 
+  nix = {
+  	settings = {
+      experimental-features = [ "nix-command" "flakes" ];
+      auto-optimise-store = true;
+      keep-outputs = true;
+      keep-derivations = true;
+      substituters = [ 
+        "https://nix-community.cachix.org" 
+      ];
+      trusted-public-keys = [
+      	"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+      ];
+  	};
+  };
+
   environment.systemPackages = with pkgs; [
-    curl git
+    unrar unzip
+    curl wget
+    # hello! if you remove this, good luck
+    # ever rebuilding your system using flakes!
+    git
   ];
 
-  i18n.defaultLocale = "en_US.UTF-8";
+  time.timeZone = lib.mkDefault "America/Los_Angeles";
 
-  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  i18n.defaultLocale = lib.mkDefault "en_US.UTF-8";
 
   system.stateVersion = lib.mkDefault "23.11";
 }

hosts/server/default.nix

@@ -10,13 +10,6 @@ in {
     ./webapps/default.nix
   ];
 
-  user = {
-    packages = with pkgs; [
-      git
-      curl
-    ];
-  };
-
   users.groups.dotfiles = {};
 
   normalUsers = {
@@ -57,7 +50,7 @@ in {
       mosh.enable = true;
     };
 
-    security.enable = true;
+    security.useDoas = true;
   };
 
   time.timeZone = "America/Los_Angeles";

modules/security.nix

@@ -5,16 +5,15 @@ let
   cfg = config.modules.security;
 in {
   options.modules.security = {
-    enable = mkOption {
+    useDoas = mkEnableOption "use doas instead of sudo";
-      type = types.bool;
-      default = true;
-    };
   };
 
   config = mkIf cfg.enable {
-    security.rtkit.enable = true;
+	boot = {
+		tmp.useTmpfs = lib.mkDefault true;
+		tmp.cleanOnBoot = lib.mkDefault (!config.boot.tmp.useTmpfs);
 		
-    boot.kernel.sysctl = {
+    	kernel.sysctl = {
       	  "kernel.sysrq" = 0;
 
           "net.ipv4.conf.all.accept_source_code" = 0;
@@ -34,4 +33,15 @@ in {
           "net.core.default_qdisc" = "cake";
         };
       };
+
+      security = {
+      	protectKernelImage = true;
+      	polkit.enable = true;
+      	rtkit.enable = true;
+      };
+    } // (mkIf cfg.useDoas {
+    	security.sudo.enable = false;
+    	security.doas.enable = true;
+    	environment.systemPackages = with pkgs; [ doas-sudo-shim ];
+    });
 }

readme.md

@@ -18,5 +18,8 @@ before committing, please run `nix flake check` and make sure everything is ok
 
 ## todo
 
+- analytics using matomo
 - php support in staticsites
 - no more luapackagepath. please stop.
+- not sure if this is cloudflare doing this or our acme config, but accessing invalid subdomains returns a dumb ssl error
+- this is not related to the flake but it is to the site. transfer from namecheap to porkbun plz