From f1fe7e38c62fbde8e310abc1d65e15ccd21fe972 Mon Sep 17 00:00:00 2001
From: reidlab <reidlab325@gmail.com>
Date: Wed, 23 Aug 2023 02:13:16 -0700
Subject: [PATCH 1/2] update perms, add security module, add flake support by
 default again

---
 default.nix              |  2 ++
 hosts/server/default.nix |  2 ++
 modules/security.nix     | 37 +++++++++++++++++++++++++++++++++++++
 3 files changed, 41 insertions(+)
 create mode 100755 modules/security.nix

diff --git a/default.nix b/default.nix
index 97e07dd..465ddb6 100755
--- a/default.nix
+++ b/default.nix
@@ -12,6 +12,8 @@ in {
   ];
 
   i18n.defaultLocale = "en_US.UTF-8";
+
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
   
   system.stateVersion = lib.mkDefault "23.11";
 }
diff --git a/hosts/server/default.nix b/hosts/server/default.nix
index a04b772..8e05c59 100755
--- a/hosts/server/default.nix
+++ b/hosts/server/default.nix
@@ -48,6 +48,8 @@
 
       mosh.enable = true;
     };
+
+    security.enable = true;
   };
 
   time.timeZone = "America/Los_Angeles";
diff --git a/modules/security.nix b/modules/security.nix
new file mode 100755
index 0000000..4dc2268
--- /dev/null
+++ b/modules/security.nix
@@ -0,0 +1,37 @@
+{ config, lib, options, pkgs, ... }:
+
+with lib;
+let
+  cfg = config.modules.security;
+in {
+  options.modules.security = {
+    enable = mkOption {
+      type = types.bool;
+      default = true;
+    };
+  };
+
+  config = mkIf cfg.enable {
+    security.rtkit.enable = true;
+
+    boot.kernel.sysctl = {
+      "kernel.sysrq" = 0;
+
+      "net.ipv4.conf.all.accept_source_code" = 0;
+      "net.ipv6.conf.all.accept_source_code" = 0;
+      "net.ipv4.conf.default.send_redirects" = 0;
+      "net.ipv4.conf.all.send_redirects" = 0;
+      "net.ipv4.conf.default.accept_redirects" = 0;
+      "net.ipv4.conf.all.accept_redirects" = 0;
+      "net.ipv6.conf.default.accept_redirects" = 0;
+      "net.ipv6.conf.all.accept_redirects" = 0;
+      "net.ipv4.conf.default.secure_redirects" = 0;
+      "net.ipv4.conf.all.secure_redirects" = 0;
+      "net.ipv4.tcp_syncookies" = 1;
+      "net.ipv4.tcp_rfc1337" = 1;
+      "net.ipv4.tcp_fastopen" = 3;
+      "net.ipv4.tcp_conjestion_control" = "bbr";
+      "net.core.default_qdisc" = "cake";
+    };
+  };
+}

From 57d42ee3c1f70f261018abfefd8f9b0d1f15dd1d Mon Sep 17 00:00:00 2001
From: reidlab <reidlab325@gmail.com>
Date: Wed, 23 Aug 2023 18:12:01 -0700
Subject: [PATCH 2/2] change readme

---
 readme.md | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/readme.md b/readme.md
index 595589b..b36a2bf 100755
--- a/readme.md
+++ b/readme.md
@@ -14,6 +14,15 @@ _Commands here will assume you are currently in the directory of the dotfiles._
 	```sh
 	sudo nixos-rebuild switch --flake ".#server"
 	```
+- To update the system:
+	```sh
+	sudo nixos-rebuild switch --upgrade --flake ".#server"
+	```
+- To test the system:
+	```sh
+	nix flake check
+	```
+
 ## Permissions
 
 _Commands here will assume you are currently in the directory of the dotfiles._