change readme

default.nix

@@ -12,6 +12,8 @@ in {
   ];
 
   i18n.defaultLocale = "en_US.UTF-8";
+
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
   
   system.stateVersion = lib.mkDefault "23.11";
 }

hosts/server/default.nix

@@ -48,6 +48,8 @@
 
       mosh.enable = true;
     };
+
+    security.enable = true;
   };
 
   time.timeZone = "America/Los_Angeles";

modules/security.nix

@@ -0,0 +1,37 @@
+{ config, lib, options, pkgs, ... }:
+
+with lib;
+let
+  cfg = config.modules.security;
+in {
+  options.modules.security = {
+    enable = mkOption {
+      type = types.bool;
+      default = true;
+    };
+  };
+
+  config = mkIf cfg.enable {
+    security.rtkit.enable = true;
+
+    boot.kernel.sysctl = {
+      "kernel.sysrq" = 0;
+
+      "net.ipv4.conf.all.accept_source_code" = 0;
+      "net.ipv6.conf.all.accept_source_code" = 0;
+      "net.ipv4.conf.default.send_redirects" = 0;
+      "net.ipv4.conf.all.send_redirects" = 0;
+      "net.ipv4.conf.default.accept_redirects" = 0;
+      "net.ipv4.conf.all.accept_redirects" = 0;
+      "net.ipv6.conf.default.accept_redirects" = 0;
+      "net.ipv6.conf.all.accept_redirects" = 0;
+      "net.ipv4.conf.default.secure_redirects" = 0;
+      "net.ipv4.conf.all.secure_redirects" = 0;
+      "net.ipv4.tcp_syncookies" = 1;
+      "net.ipv4.tcp_rfc1337" = 1;
+      "net.ipv4.tcp_fastopen" = 3;
+      "net.ipv4.tcp_conjestion_control" = "bbr";
+      "net.core.default_qdisc" = "cake";
+    };
+  };
+}

readme.md

@@ -14,6 +14,15 @@ _Commands here will assume you are currently in the directory of the dotfiles._
 	```sh
 	sudo nixos-rebuild switch --flake ".#server"
 	```
+- To update the system:
+	```sh
+	sudo nixos-rebuild switch --upgrade --flake ".#server"
+	```
+- To test the system:
+	```sh
+	nix flake check
+	```
+
 ## Permissions
 
 _Commands here will assume you are currently in the directory of the dotfiles._