reidlab/nix-server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

update perms, add security module, add flake support by default again

Browse source
This commit is contained in:
Reid 2023-08-23 02:13:16 -07:00
parent 63d45da9ff
commit f1fe7e38c6
3 changed files with 41 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
default.nix
View file

@ -13,5 +13,7 @@ in {
i18n.defaultLocale = "en_US.UTF-8"; i18n.defaultLocale = "en_US.UTF-8";
nix.settings.experimental-features = [ "nix-command" "flakes" ];
system.stateVersion = lib.mkDefault "23.11"; system.stateVersion = lib.mkDefault "23.11";
} }

2
hosts/server/default.nix
View file

@ -48,6 +48,8 @@
mosh.enable = true; mosh.enable = true;
}; };
security.enable = true;
}; };
time.timeZone = "America/Los_Angeles"; time.timeZone = "America/Los_Angeles";

37
modules/security.nix Executable file
View file

@ -0,0 +1,37 @@
{ config, lib, options, pkgs, ... }:
with lib;
let
cfg = config.modules.security;
in {
options.modules.security = {
enable = mkOption {
type = types.bool;
default = true;
};
};
config = mkIf cfg.enable {
security.rtkit.enable = true;
boot.kernel.sysctl = {
"kernel.sysrq" = 0;
"net.ipv4.conf.all.accept_source_code" = 0;
"net.ipv6.conf.all.accept_source_code" = 0;
"net.ipv4.conf.default.send_redirects" = 0;
"net.ipv4.conf.all.send_redirects" = 0;
"net.ipv4.conf.default.accept_redirects" = 0;
"net.ipv4.conf.all.accept_redirects" = 0;
"net.ipv6.conf.default.accept_redirects" = 0;
"net.ipv6.conf.all.accept_redirects" = 0;
"net.ipv4.conf.default.secure_redirects" = 0;
"net.ipv4.conf.all.secure_redirects" = 0;
"net.ipv4.tcp_syncookies" = 1;
"net.ipv4.tcp_rfc1337" = 1;
"net.ipv4.tcp_fastopen" = 3;
"net.ipv4.tcp_conjestion_control" = "bbr";
"net.core.default_qdisc" = "cake";
};
};
}