refactor: major structural changes
git updates update tmux conf add ansible tools squash me squash fix: get git aliases from plugin virt stuff add devenv some virt updates kubernetes
This commit is contained in:
Glen Goodwin
parent
2e8c1eec90
commit
2220c4e917
87 changed files with 1963 additions and 2261 deletions
7
hosts/candlekeep/auditd.nix
Normal file
7
hosts/candlekeep/auditd.nix
Normal file
|
|
@ -0,0 +1,7 @@
|
|||
{...}: {
|
||||
security.auditd.enable = true;
|
||||
security.audit.enable = true;
|
||||
security.audit.rules = [
|
||||
"-a exit,always -F arch=b64 -S execve"
|
||||
];
|
||||
}
|
||||
125
hosts/candlekeep/configuration.nix
Normal file
125
hosts/candlekeep/configuration.nix
Normal file
|
|
@ -0,0 +1,125 @@
|
|||
# This is your system's configuration file.
|
||||
# Use this to configure your system environment (it replaces /etc/nixos/configuration.nix)
|
||||
{
|
||||
inputs,
|
||||
outputs,
|
||||
lib,
|
||||
config,
|
||||
pkgs,
|
||||
user,
|
||||
...
|
||||
}: {
|
||||
# You can import other NixOS modules here
|
||||
imports = [
|
||||
# If you want to use modules your own flake exports (from modules/nixos):
|
||||
# outputs.nixosModules.example
|
||||
../../common/nixos/common.nix
|
||||
../../common/networking/zerotier.nix
|
||||
../../common/nixos/bluetooth.nix
|
||||
../../common/gui/hyprland.nix
|
||||
../../common/gui/thunar.nix
|
||||
../../common/style/stylix.nix
|
||||
../../common/virtualization/podman.nix
|
||||
../../common/virtualization/kubernetes.nix
|
||||
../../common/virtualization/libvirt.nix
|
||||
|
||||
./auditd.nix
|
||||
./kernel.nix
|
||||
./sysctl.nix
|
||||
|
||||
# Or modules from other flakes (such as nixos-hardware):
|
||||
# inputs.hardware.nixosModules.common-cpu-amd
|
||||
# inputs.hardware.nixosModules.common-ssd
|
||||
inputs.nix-index-database.nixosModules.nix-index
|
||||
inputs.stylix.nixosModules.stylix
|
||||
# You can also split up your configuration and import pieces of it here:
|
||||
# ./users.nix
|
||||
|
||||
# Import your generated (nixos-generate-config) hardware configuration
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
|
||||
nixpkgs = {
|
||||
# You can add overlays here
|
||||
overlays = [
|
||||
# Add overlays your own flake exports (from overlays and pkgs dir):
|
||||
outputs.overlays.additions
|
||||
outputs.overlays.modifications
|
||||
outputs.overlays.unstable-packages
|
||||
|
||||
# You can also add overlays exported from other flakes:
|
||||
# neovim-nightly-overlay.overlays.default
|
||||
|
||||
# Or define it inline, for example:
|
||||
# (final: prev: {
|
||||
# hi = final.hello.overrideAttrs (oldAttrs: {
|
||||
# patches = [ ./change-hello-to-hi.patch ];
|
||||
# });
|
||||
# })
|
||||
];
|
||||
# Configure your nixpkgs instance
|
||||
config = {
|
||||
# Disable if you don't want unfree packages
|
||||
allowUnfree = true;
|
||||
};
|
||||
};
|
||||
|
||||
# This will add each flake input as a registry
|
||||
# To make nix3 commands consistent with your flake
|
||||
nix.registry = (lib.mapAttrs (_: flake: {inherit flake;})) ((lib.filterAttrs (_: lib.isType "flake")) inputs);
|
||||
|
||||
# This will additionally add your inputs to the system's legacy channels
|
||||
# Making legacy nix commands consistent as well, awesome!
|
||||
nix.nixPath = ["/etc/nix/path"];
|
||||
environment.etc =
|
||||
lib.mapAttrs'
|
||||
(name: value: {
|
||||
name = "nix/path/${name}";
|
||||
value.source = value.flake;
|
||||
})
|
||||
config.nix.registry;
|
||||
|
||||
networking.hostName = "candlekeep";
|
||||
networking.networkmanager.enable = true;
|
||||
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
|
||||
users.users = {
|
||||
gwg313 = {
|
||||
initialPassword = "correcthorsebatterystaple";
|
||||
isNormalUser = true;
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ/cWqqTUuLswymQVh9rKdUWgMNNtZE6PwXMNUgD8/Zx gwg313"
|
||||
];
|
||||
extraGroups = ["wheel"];
|
||||
};
|
||||
};
|
||||
|
||||
# This setups a SSH server. Very important if you're setting up a headless system.
|
||||
# Feel free to remove if you don't need it.
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
# Forbid root login through SSH.
|
||||
PermitRootLogin = "no";
|
||||
# Use keys only. Remove if you want to SSH using password (not recommended)
|
||||
PasswordAuthentication = false;
|
||||
};
|
||||
};
|
||||
|
||||
environment = {
|
||||
loginShellInit = ''
|
||||
if [ -z $DISPLAY ] && [ "$(tty)" = "/dev/tty1" ]; then
|
||||
exec Hyprland
|
||||
fi
|
||||
''; # Will automatically open Hyprland when logged into tty1
|
||||
variables = {
|
||||
TERMINAL = "alacritty";
|
||||
EDITOR = "nvim";
|
||||
VISUAL = "nvim";
|
||||
PAGER = "moar";
|
||||
};
|
||||
};
|
||||
# https://nixos.wiki/wiki/FAQ/When_do_I_update_stateVersion
|
||||
system.stateVersion = "23.05";
|
||||
}
|
||||
47
hosts/candlekeep/hardware-configuration.nix
Normal file
47
hosts/candlekeep/hardware-configuration.nix
Normal file
|
|
@ -0,0 +1,47 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
modulesPath,
|
||||
...
|
||||
}: {
|
||||
imports = [
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = ["nvme" "xhci_pci" "usb_storage" "sd_mod" "rtsx_pci_sdmmc"];
|
||||
boot.initrd.kernelModules = [];
|
||||
boot.kernelModules = ["kvm-amd"];
|
||||
boot.extraModulePackages = [];
|
||||
|
||||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-uuid/58fedfa4-d796-4e8f-a79d-2aa6b0f51909";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
boot.initrd.luks.devices."luks-d24cbf42-c364-49e5-b569-34accd6e46cb".device = "/dev/disk/by-uuid/d24cbf42-c364-49e5-b569-34accd6e46cb";
|
||||
|
||||
fileSystems."/boot" = {
|
||||
device = "/dev/disk/by-uuid/9D09-4864";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
swapDevices = [
|
||||
{device = "/dev/disk/by-uuid/0144132b-146b-4156-9518-67450854b736";}
|
||||
];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp2s0f0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp5s0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.wlp3s0.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
26
hosts/candlekeep/kernel.nix
Normal file
26
hosts/candlekeep/kernel.nix
Normal file
|
|
@ -0,0 +1,26 @@
|
|||
{
|
||||
config,
|
||||
pkgs,
|
||||
stdenv,
|
||||
...
|
||||
}: {
|
||||
boot.kernelPackages = pkgs.linuxPackages_hardened;
|
||||
boot.kernelParams = [
|
||||
# Disable slab merging to prevent heap exploitation
|
||||
"slab_nomerge"
|
||||
# Enable zeroing memory during allocation and free time
|
||||
"init_on_alloc=1"
|
||||
"init_on_free=1"
|
||||
# Randomize page allocator freelists
|
||||
"page_alloc.shuffle=1"
|
||||
# Mitigations
|
||||
"pti=on"
|
||||
|
||||
"vsyscall=none"
|
||||
"debugfs=off"
|
||||
"oops=panic"
|
||||
|
||||
# Enable lockdown LSM
|
||||
"lockdown=confidentiality"
|
||||
];
|
||||
}
|
||||
62
hosts/candlekeep/sysctl.nix
Normal file
62
hosts/candlekeep/sysctl.nix
Normal file
|
|
@ -0,0 +1,62 @@
|
|||
{
|
||||
config,
|
||||
pkgs,
|
||||
...
|
||||
}: {
|
||||
boot.kernel.sysctl = {
|
||||
# Restrict kernel pointers
|
||||
"kernel.kptr_restrict" = 2;
|
||||
|
||||
"kernel.dmesg_restrict" = 1;
|
||||
|
||||
# Restrict eBPF
|
||||
"kernel.unprivileged_bpf_disabled" = 1;
|
||||
|
||||
# Harden JIT
|
||||
"net.core.bpf_jit_harden" = 2;
|
||||
|
||||
"dev.tty.ldisc_autoload" = 0;
|
||||
"vm.unprivileged_userfaultfd" = 0;
|
||||
|
||||
# Disable loading other kernels at runtime
|
||||
"kernel.kexec_load_disabled" = 1;
|
||||
|
||||
# Disable SysRq key for non-users (can be used in remote exploits)
|
||||
"kernel.sysrq" = 4;
|
||||
|
||||
"kernel.perf_event_paranoid" = 3;
|
||||
"kernel.unprivileged_userns_clone" = 1;
|
||||
|
||||
## NETWORK
|
||||
|
||||
# SYN flood attack prevention
|
||||
"net.ipv4.tcp_syncookies" = 1;
|
||||
|
||||
# Prevent IP spoofing
|
||||
"net.ipv4.conf.all.rp_filter" = 1;
|
||||
"net.ipv4.conf.default.rp_filter" = 1;
|
||||
|
||||
# MITM attack prevention (disable redirect acceptance)
|
||||
"net.ipv4.conf.all.accept_redirects" = 0;
|
||||
"net.ipv4.conf.default.accept_redirects" = 0;
|
||||
"net.ipv4.conf.all.secure_redirects" = 0;
|
||||
"net.ipv4.conf.default.secure_redirects" = 0;
|
||||
"net.ipv6.conf.all.accept_redirects" = 0;
|
||||
"net.ipv6.conf.default.accept_redirects" = 0;
|
||||
"net.ipv4.conf.all.send_redirects" = 0;
|
||||
"net.ipv4.conf.default.send_redirects" = 0;
|
||||
|
||||
# Clock fingerprinting prevention (disabled ICMP requests)
|
||||
"net.ipv4.icmp_echo_ignore_all" = 1;
|
||||
|
||||
# Restrict ptrace usage
|
||||
"kernel.yama.ptrace_scope" = 2;
|
||||
|
||||
# ASLR exploit mitigation
|
||||
"vm.mmap_rnd_bits" = 32;
|
||||
"vm.mmap_rnd_compat_bits" = 16;
|
||||
|
||||
"fs.protected_fifos" = 2;
|
||||
"fs.protected_regular" = 2;
|
||||
};
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue