8 files changed, 3 insertions, 177 deletions
diff --git a/nixos/default.nix b/nixos/default.nix
index 611aa1d..ed40dad 100644
--- a/nixos/default.nix
+++ b/nixos/default.nix
@@ -5,8 +5,8 @@
     name = "alpha";
     nixpkgs = unstable;
     extraModules = [
-      ./modules/security.nix
-      ./modules/cachix
+      ../modules/security.nix
+      ../modules/cachix
       inputs.sops-nix.nixosModules.sops
     ];
   };
@@ -16,7 +16,7 @@
     system = "aarch64-linux";
     nixpkgs = unstable-small;
     extraModules = [
-      ./modules/security.nix
+      ../modules/security.nix
     ];
   };
 
diff --git a/nixos/modules/cachix/caches/helix.nix b/nixos/modules/cachix/caches/helix.nix
deleted file mode 100644
index 7783a96..0000000
--- a/nixos/modules/cachix/caches/helix.nix
+++ /dev/null
@@ -1,12 +0,0 @@
-{ config, lib, ... }:
-
-{
-  nix.settings = {
-    substituters = [
-      "https://helix.cachix.org"
-    ];
-    trusted-public-keys = [
-      "helix.cachix.org-1:ejp9KQpR1FBI2onstMQ34yogDm4OgU2ru6lIwPvuCVs="
-    ];
-  };
-}
diff --git a/nixos/modules/cachix/caches/nix-community.nix b/nixos/modules/cachix/caches/nix-community.nix
deleted file mode 100644
index d323939..0000000
--- a/nixos/modules/cachix/caches/nix-community.nix
+++ /dev/null
@@ -1,12 +0,0 @@
-{ config, lib, ... }:
-
-{
-  nix.settings = {
-    substituters = [
-      "https://nix-community.cachix.org"
-    ];
-    trusted-public-keys = [
-      "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
-    ];
-  };
-}
diff --git a/nixos/modules/cachix/default.nix b/nixos/modules/cachix/default.nix
deleted file mode 100644
index 9dd55b5..0000000
--- a/nixos/modules/cachix/default.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{ config, pkgs, lib, ... }:
-let
-  folder = ./caches;
-  toImport = name: value: folder + ("/" + name);
-  filterCaches = key: value: value == "regular" && lib.hasSuffix ".nix" key;
-  imports = lib.mapAttrsToList toImport (lib.filterAttrs filterCaches (builtins.readDir folder));
-in
-{
-  inherit imports;
-  nix.settings.substituters = [ "https://cache.nixos.org/" ];
-
-  environment.systemPackages = [ pkgs.cachix ];
-}
diff --git a/nixos/modules/default.nix b/nixos/modules/default.nix
deleted file mode 100644
index df11f91..0000000
--- a/nixos/modules/default.nix
+++ /dev/null
@@ -1,6 +0,0 @@
-{
-  cachix = import ./cachix;
-  flakes = import ./flakes.nix;
-  nix = import ./nix.nix;
-  security = import ./security.nix;
-}
diff --git a/nixos/modules/flakes.nix b/nixos/modules/flakes.nix
deleted file mode 100644
index 76f89f3..0000000
--- a/nixos/modules/flakes.nix
+++ /dev/null
@@ -1,35 +0,0 @@
-{ config, pkgs, unstable, unstable-small, nixpkgs-2211, lib, ... }:
-
-let
-  base = "/etc/nixpkgs/channels";
-  nixpkgsPath = "${base}/nixpkgs";
-  nixpkgsSmallPath = "${base}/nixpkgsSmall";
-  nixpkgs2211Path = "${base}/nixpkgs2211";
-in
-{
-  options.nix.flakes.enable = lib.mkEnableOption "nix flakes";
-
-  config = lib.mkIf config.nix.flakes.enable {
-    nix = {
-      package = pkgs.nixUnstable;
-      experimentalFeatures = "nix-command flakes";
-
-      registry.nixpkgs.flake = unstable;
-      registry.nixpkgsSmall.flake = unstable-small;
-      registry.nixpkgs2211.flake = nixpkgs-2211;
-
-      nixPath = [
-        "nixpkgs=${nixpkgsPath}"
-        "nixpkgsSmall=${nixpkgsSmallPath}"
-        "nixpkgs2211=${nixpkgs2211Path}"
-        "/nix/var/nix/profiles/per-user/root/channels"
-      ];
-    };
-
-    systemd.tmpfiles.rules = [
-      "L+ ${nixpkgsPath}         - - - - ${unstable}"
-      "L+ ${nixpkgsSmallPath} - - - - ${unstable-small}"
-      "L+ ${nixpkgs2211Path} - - - - ${nixpkgs-2211}"
-    ];
-  };
-}
diff --git a/nixos/modules/nix.nix b/nixos/modules/nix.nix
deleted file mode 100644
index 8396739..0000000
--- a/nixos/modules/nix.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{ config, lib, ... }:
-
-let
-  allowed = config.nix.allowedUnfree;
-in
-{
-  options.nix = {
-    experimentalFeatures = lib.mkOption {
-      type = lib.types.separatedString " ";
-      default = "";
-      description = ''
-        Enables experimental features
-      '';
-    };
-
-    allowedUnfree = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      default = [ ];
-      description = ''
-        Allows for  unfree packages by their name.
-      '';
-    };
-  };
-
-  config = lib.mkMerge [
-    (lib.mkIf (config.nix.experimentalFeatures != "") { nix.extraOptions = "experimental-features = ${config.nix.experimentalFeatures}"; })
-    (lib.mkIf (allowed != [ ]) { nixpkgs.config.allowUnfreePredicate = (pkg: __elem (lib.getName pkg) allowed); })
-    { nix.settings.auto-optimise-store = lib.mkDefault true; }
-    {
-      nix.gc.automatic = lib.mkDefault true;
-      nix.gc.options = lib.mkDefault "--delete-older-than 10d";
-    }
-  ];
-}
diff --git a/nixos/modules/security.nix b/nixos/modules/security.nix
deleted file mode 100644
index 358f27b..0000000
--- a/nixos/modules/security.nix
+++ /dev/null
@@ -1,62 +0,0 @@
-{ config, lib, ... }:
-
-{
-  # Security-related system tweaks
-
-  # Prevent replacing the running kernel without reboot.
-  security.protectKernelImage = true;
-
-  # mount /tmp in ram. This makes temp file management faster
-  # on ssd systems, and volatile! Because it's wiped on reboot.
-  boot.tmp.useTmpfs = false;
-  boot.tmp.tmpfsSize = "80%";
-
-  # Purge /tmp on boot. (fallback option)
-  boot.tmp.cleanOnBoot = lib.mkDefault (!config.boot.tmp.useTmpfs);
-
-  boot.kernel.sysctl = {
-    # The Magic SysRq key is a key combo that allows users connected to the
-    # system console of a Linux kernel to perform some low-level commands.
-    # Disable it, since we don't need it, and is a potential security concern.
-    "kernel.sysrq" = 0;
-
-    ## TCP hardening
-    # Prevent bogus ICMP errors from filling up logs.
-    "net.ipv4.icmp_ignore_bogus_error_responses" = 1;
-    # Reverse path filtering causes the kernel to do source validation of
-    # packets received from all interfaces. This can mitigate IP spoofing.
-    "net.ipv4.conf.default.rp_filter" = 1;
-    "net.ipv4.conf.all.rp_filter" = 1;
-    # Do not accept IP source route packets (we're not a router)
-    "net.ipv4.conf.all.accept_source_route" = 0;
-    "net.ipv6.conf.all.accept_source_route" = 0;
-    # Don't send ICMP redirects (again, we're on a router)
-    "net.ipv4.conf.all.send_redirects" = 0;
-    "net.ipv4.conf.default.send_redirects" = 0;
-    # Refuse ICMP redirects (MITM mitigations)
-    "net.ipv4.conf.all.accept_redirects" = 0;
-    "net.ipv4.conf.default.accept_redirects" = 0;
-    "net.ipv4.conf.all.secure_redirects" = 0;
-    "net.ipv4.conf.default.secure_redirects" = 0;
-    "net.ipv6.conf.all.accept_redirects" = 0;
-    "net.ipv6.conf.default.accept_redirects" = 0;
-    # Protects against SYN flood attacks
-    "net.ipv4.tcp_syncookies" = 1;
-    # Incomplete protection again TIME-WAIT assassination
-    "net.ipv4.tcp_rfc1337" = 1;
-
-    ## TCP optimization
-    # TCP Fast Open is a TCP extension that reduces network latency by packing
-    # data in the sender’s initial TCP SYN. Setting 3 = enable TCP Fast Open for
-    # both incoming and outgoing connections:
-    "net.ipv4.tcp_fastopen" = 3;
-    # Bufferbloat mitigations + slight improvement in throughput & latency
-    "net.ipv4.tcp_congestion_control" = "bbr";
-    "net.core.default_qdisc" = "cake";
-  };
-
-  boot.kernelModules = [ "tcp_bbr" ];
-
-  # Accept CA's ToS.
-  security.acme.acceptTerms = true;
-}