From bc4039ae8c86f794cece9d9ceb43b838e61cf445 Mon Sep 17 00:00:00 2001 From: sefidel Date: Mon, 21 Aug 2023 19:20:36 +0900 Subject: chore: nixos/modules -> modules --- darwin/default.nix | 2 +- lib/mk_darwin.nix | 2 +- lib/mk_system.nix | 4 +- modules/cachix/caches/helix.nix | 12 ++++++ modules/cachix/caches/nix-community.nix | 12 ++++++ modules/cachix/default.nix | 13 ++++++ modules/default.nix | 6 +++ modules/flakes.nix | 35 +++++++++++++++ modules/nix.nix | 34 +++++++++++++++ modules/security.nix | 62 +++++++++++++++++++++++++++ nixos/default.nix | 6 +-- nixos/modules/cachix/caches/helix.nix | 12 ------ nixos/modules/cachix/caches/nix-community.nix | 12 ------ nixos/modules/cachix/default.nix | 13 ------ nixos/modules/default.nix | 6 --- nixos/modules/flakes.nix | 35 --------------- nixos/modules/nix.nix | 34 --------------- nixos/modules/security.nix | 62 --------------------------- 18 files changed, 181 insertions(+), 181 deletions(-) create mode 100644 modules/cachix/caches/helix.nix create mode 100644 modules/cachix/caches/nix-community.nix create mode 100644 modules/cachix/default.nix create mode 100644 modules/default.nix create mode 100644 modules/flakes.nix create mode 100644 modules/nix.nix create mode 100644 modules/security.nix delete mode 100644 nixos/modules/cachix/caches/helix.nix delete mode 100644 nixos/modules/cachix/caches/nix-community.nix delete mode 100644 nixos/modules/cachix/default.nix delete mode 100644 nixos/modules/default.nix delete mode 100644 nixos/modules/flakes.nix delete mode 100644 nixos/modules/nix.nix delete mode 100644 nixos/modules/security.nix diff --git a/darwin/default.nix b/darwin/default.nix index 1476617..acc1fcb 100644 --- a/darwin/default.nix +++ b/darwin/default.nix @@ -6,7 +6,7 @@ system = "aarch64-darwin"; nixpkgs = unstable; extraModules = [ - ../nixos/modules/cachix + ../modules/cachix ]; }; } diff --git a/lib/mk_darwin.nix b/lib/mk_darwin.nix index 1e81a3c..de4fc4e 100644 --- a/lib/mk_darwin.nix +++ b/lib/mk_darwin.nix @@ -16,7 +16,7 @@ darwin.lib.darwinSystem ( networking.hostName = name; } entryPoint - ../nixos/modules/nix.nix + ../modules/nix.nix ] ++ nixpkgs.lib.optional (overlays != null) { nixpkgs.overlays = overlays; } ++ nixpkgs.lib.optionals (extraModules != null) extraModules; } diff --git a/lib/mk_system.nix b/lib/mk_system.nix index 1753522..a1a4eab 100644 --- a/lib/mk_system.nix +++ b/lib/mk_system.nix @@ -21,8 +21,8 @@ nixpkgs.lib.nixosSystem ( } entryPoint hardware - ../nixos/modules/flakes.nix - ../nixos/modules/nix.nix + ../modules/flakes.nix + ../modules/nix.nix ] ++ nixpkgs.lib.optional (overlays != null) { nixpkgs.overlays = overlays; } ++ nixpkgs.lib.optionals (extraModules != null) extraModules; } diff --git a/modules/cachix/caches/helix.nix b/modules/cachix/caches/helix.nix new file mode 100644 index 0000000..7783a96 --- /dev/null +++ b/modules/cachix/caches/helix.nix @@ -0,0 +1,12 @@ +{ config, lib, ... }: + +{ + nix.settings = { + substituters = [ + "https://helix.cachix.org" + ]; + trusted-public-keys = [ + "helix.cachix.org-1:ejp9KQpR1FBI2onstMQ34yogDm4OgU2ru6lIwPvuCVs=" + ]; + }; +} diff --git a/modules/cachix/caches/nix-community.nix b/modules/cachix/caches/nix-community.nix new file mode 100644 index 0000000..d323939 --- /dev/null +++ b/modules/cachix/caches/nix-community.nix @@ -0,0 +1,12 @@ +{ config, lib, ... }: + +{ + nix.settings = { + substituters = [ + "https://nix-community.cachix.org" + ]; + trusted-public-keys = [ + "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" + ]; + }; +} diff --git a/modules/cachix/default.nix b/modules/cachix/default.nix new file mode 100644 index 0000000..9dd55b5 --- /dev/null +++ b/modules/cachix/default.nix @@ -0,0 +1,13 @@ +{ config, pkgs, lib, ... }: +let + folder = ./caches; + toImport = name: value: folder + ("/" + name); + filterCaches = key: value: value == "regular" && lib.hasSuffix ".nix" key; + imports = lib.mapAttrsToList toImport (lib.filterAttrs filterCaches (builtins.readDir folder)); +in +{ + inherit imports; + nix.settings.substituters = [ "https://cache.nixos.org/" ]; + + environment.systemPackages = [ pkgs.cachix ]; +} diff --git a/modules/default.nix b/modules/default.nix new file mode 100644 index 0000000..df11f91 --- /dev/null +++ b/modules/default.nix @@ -0,0 +1,6 @@ +{ + cachix = import ./cachix; + flakes = import ./flakes.nix; + nix = import ./nix.nix; + security = import ./security.nix; +} diff --git a/modules/flakes.nix b/modules/flakes.nix new file mode 100644 index 0000000..76f89f3 --- /dev/null +++ b/modules/flakes.nix @@ -0,0 +1,35 @@ +{ config, pkgs, unstable, unstable-small, nixpkgs-2211, lib, ... }: + +let + base = "/etc/nixpkgs/channels"; + nixpkgsPath = "${base}/nixpkgs"; + nixpkgsSmallPath = "${base}/nixpkgsSmall"; + nixpkgs2211Path = "${base}/nixpkgs2211"; +in +{ + options.nix.flakes.enable = lib.mkEnableOption "nix flakes"; + + config = lib.mkIf config.nix.flakes.enable { + nix = { + package = pkgs.nixUnstable; + experimentalFeatures = "nix-command flakes"; + + registry.nixpkgs.flake = unstable; + registry.nixpkgsSmall.flake = unstable-small; + registry.nixpkgs2211.flake = nixpkgs-2211; + + nixPath = [ + "nixpkgs=${nixpkgsPath}" + "nixpkgsSmall=${nixpkgsSmallPath}" + "nixpkgs2211=${nixpkgs2211Path}" + "/nix/var/nix/profiles/per-user/root/channels" + ]; + }; + + systemd.tmpfiles.rules = [ + "L+ ${nixpkgsPath} - - - - ${unstable}" + "L+ ${nixpkgsSmallPath} - - - - ${unstable-small}" + "L+ ${nixpkgs2211Path} - - - - ${nixpkgs-2211}" + ]; + }; +} diff --git a/modules/nix.nix b/modules/nix.nix new file mode 100644 index 0000000..8396739 --- /dev/null +++ b/modules/nix.nix @@ -0,0 +1,34 @@ +{ config, lib, ... }: + +let + allowed = config.nix.allowedUnfree; +in +{ + options.nix = { + experimentalFeatures = lib.mkOption { + type = lib.types.separatedString " "; + default = ""; + description = '' + Enables experimental features + ''; + }; + + allowedUnfree = lib.mkOption { + type = lib.types.listOf lib.types.str; + default = [ ]; + description = '' + Allows for unfree packages by their name. + ''; + }; + }; + + config = lib.mkMerge [ + (lib.mkIf (config.nix.experimentalFeatures != "") { nix.extraOptions = "experimental-features = ${config.nix.experimentalFeatures}"; }) + (lib.mkIf (allowed != [ ]) { nixpkgs.config.allowUnfreePredicate = (pkg: __elem (lib.getName pkg) allowed); }) + { nix.settings.auto-optimise-store = lib.mkDefault true; } + { + nix.gc.automatic = lib.mkDefault true; + nix.gc.options = lib.mkDefault "--delete-older-than 10d"; + } + ]; +} diff --git a/modules/security.nix b/modules/security.nix new file mode 100644 index 0000000..358f27b --- /dev/null +++ b/modules/security.nix @@ -0,0 +1,62 @@ +{ config, lib, ... }: + +{ + # Security-related system tweaks + + # Prevent replacing the running kernel without reboot. + security.protectKernelImage = true; + + # mount /tmp in ram. This makes temp file management faster + # on ssd systems, and volatile! Because it's wiped on reboot. + boot.tmp.useTmpfs = false; + boot.tmp.tmpfsSize = "80%"; + + # Purge /tmp on boot. (fallback option) + boot.tmp.cleanOnBoot = lib.mkDefault (!config.boot.tmp.useTmpfs); + + boot.kernel.sysctl = { + # The Magic SysRq key is a key combo that allows users connected to the + # system console of a Linux kernel to perform some low-level commands. + # Disable it, since we don't need it, and is a potential security concern. + "kernel.sysrq" = 0; + + ## TCP hardening + # Prevent bogus ICMP errors from filling up logs. + "net.ipv4.icmp_ignore_bogus_error_responses" = 1; + # Reverse path filtering causes the kernel to do source validation of + # packets received from all interfaces. This can mitigate IP spoofing. + "net.ipv4.conf.default.rp_filter" = 1; + "net.ipv4.conf.all.rp_filter" = 1; + # Do not accept IP source route packets (we're not a router) + "net.ipv4.conf.all.accept_source_route" = 0; + "net.ipv6.conf.all.accept_source_route" = 0; + # Don't send ICMP redirects (again, we're on a router) + "net.ipv4.conf.all.send_redirects" = 0; + "net.ipv4.conf.default.send_redirects" = 0; + # Refuse ICMP redirects (MITM mitigations) + "net.ipv4.conf.all.accept_redirects" = 0; + "net.ipv4.conf.default.accept_redirects" = 0; + "net.ipv4.conf.all.secure_redirects" = 0; + "net.ipv4.conf.default.secure_redirects" = 0; + "net.ipv6.conf.all.accept_redirects" = 0; + "net.ipv6.conf.default.accept_redirects" = 0; + # Protects against SYN flood attacks + "net.ipv4.tcp_syncookies" = 1; + # Incomplete protection again TIME-WAIT assassination + "net.ipv4.tcp_rfc1337" = 1; + + ## TCP optimization + # TCP Fast Open is a TCP extension that reduces network latency by packing + # data in the sender’s initial TCP SYN. Setting 3 = enable TCP Fast Open for + # both incoming and outgoing connections: + "net.ipv4.tcp_fastopen" = 3; + # Bufferbloat mitigations + slight improvement in throughput & latency + "net.ipv4.tcp_congestion_control" = "bbr"; + "net.core.default_qdisc" = "cake"; + }; + + boot.kernelModules = [ "tcp_bbr" ]; + + # Accept CA's ToS. + security.acme.acceptTerms = true; +} diff --git a/nixos/default.nix b/nixos/default.nix index 611aa1d..ed40dad 100644 --- a/nixos/default.nix +++ b/nixos/default.nix @@ -5,8 +5,8 @@ name = "alpha"; nixpkgs = unstable; extraModules = [ - ./modules/security.nix - ./modules/cachix + ../modules/security.nix + ../modules/cachix inputs.sops-nix.nixosModules.sops ]; }; @@ -16,7 +16,7 @@ system = "aarch64-linux"; nixpkgs = unstable-small; extraModules = [ - ./modules/security.nix + ../modules/security.nix ]; }; diff --git a/nixos/modules/cachix/caches/helix.nix b/nixos/modules/cachix/caches/helix.nix deleted file mode 100644 index 7783a96..0000000 --- a/nixos/modules/cachix/caches/helix.nix +++ /dev/null @@ -1,12 +0,0 @@ -{ config, lib, ... }: - -{ - nix.settings = { - substituters = [ - "https://helix.cachix.org" - ]; - trusted-public-keys = [ - "helix.cachix.org-1:ejp9KQpR1FBI2onstMQ34yogDm4OgU2ru6lIwPvuCVs=" - ]; - }; -} diff --git a/nixos/modules/cachix/caches/nix-community.nix b/nixos/modules/cachix/caches/nix-community.nix deleted file mode 100644 index d323939..0000000 --- a/nixos/modules/cachix/caches/nix-community.nix +++ /dev/null @@ -1,12 +0,0 @@ -{ config, lib, ... }: - -{ - nix.settings = { - substituters = [ - "https://nix-community.cachix.org" - ]; - trusted-public-keys = [ - "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" - ]; - }; -} diff --git a/nixos/modules/cachix/default.nix b/nixos/modules/cachix/default.nix deleted file mode 100644 index 9dd55b5..0000000 --- a/nixos/modules/cachix/default.nix +++ /dev/null @@ -1,13 +0,0 @@ -{ config, pkgs, lib, ... }: -let - folder = ./caches; - toImport = name: value: folder + ("/" + name); - filterCaches = key: value: value == "regular" && lib.hasSuffix ".nix" key; - imports = lib.mapAttrsToList toImport (lib.filterAttrs filterCaches (builtins.readDir folder)); -in -{ - inherit imports; - nix.settings.substituters = [ "https://cache.nixos.org/" ]; - - environment.systemPackages = [ pkgs.cachix ]; -} diff --git a/nixos/modules/default.nix b/nixos/modules/default.nix deleted file mode 100644 index df11f91..0000000 --- a/nixos/modules/default.nix +++ /dev/null @@ -1,6 +0,0 @@ -{ - cachix = import ./cachix; - flakes = import ./flakes.nix; - nix = import ./nix.nix; - security = import ./security.nix; -} diff --git a/nixos/modules/flakes.nix b/nixos/modules/flakes.nix deleted file mode 100644 index 76f89f3..0000000 --- a/nixos/modules/flakes.nix +++ /dev/null @@ -1,35 +0,0 @@ -{ config, pkgs, unstable, unstable-small, nixpkgs-2211, lib, ... }: - -let - base = "/etc/nixpkgs/channels"; - nixpkgsPath = "${base}/nixpkgs"; - nixpkgsSmallPath = "${base}/nixpkgsSmall"; - nixpkgs2211Path = "${base}/nixpkgs2211"; -in -{ - options.nix.flakes.enable = lib.mkEnableOption "nix flakes"; - - config = lib.mkIf config.nix.flakes.enable { - nix = { - package = pkgs.nixUnstable; - experimentalFeatures = "nix-command flakes"; - - registry.nixpkgs.flake = unstable; - registry.nixpkgsSmall.flake = unstable-small; - registry.nixpkgs2211.flake = nixpkgs-2211; - - nixPath = [ - "nixpkgs=${nixpkgsPath}" - "nixpkgsSmall=${nixpkgsSmallPath}" - "nixpkgs2211=${nixpkgs2211Path}" - "/nix/var/nix/profiles/per-user/root/channels" - ]; - }; - - systemd.tmpfiles.rules = [ - "L+ ${nixpkgsPath} - - - - ${unstable}" - "L+ ${nixpkgsSmallPath} - - - - ${unstable-small}" - "L+ ${nixpkgs2211Path} - - - - ${nixpkgs-2211}" - ]; - }; -} diff --git a/nixos/modules/nix.nix b/nixos/modules/nix.nix deleted file mode 100644 index 8396739..0000000 --- a/nixos/modules/nix.nix +++ /dev/null @@ -1,34 +0,0 @@ -{ config, lib, ... }: - -let - allowed = config.nix.allowedUnfree; -in -{ - options.nix = { - experimentalFeatures = lib.mkOption { - type = lib.types.separatedString " "; - default = ""; - description = '' - Enables experimental features - ''; - }; - - allowedUnfree = lib.mkOption { - type = lib.types.listOf lib.types.str; - default = [ ]; - description = '' - Allows for unfree packages by their name. - ''; - }; - }; - - config = lib.mkMerge [ - (lib.mkIf (config.nix.experimentalFeatures != "") { nix.extraOptions = "experimental-features = ${config.nix.experimentalFeatures}"; }) - (lib.mkIf (allowed != [ ]) { nixpkgs.config.allowUnfreePredicate = (pkg: __elem (lib.getName pkg) allowed); }) - { nix.settings.auto-optimise-store = lib.mkDefault true; } - { - nix.gc.automatic = lib.mkDefault true; - nix.gc.options = lib.mkDefault "--delete-older-than 10d"; - } - ]; -} diff --git a/nixos/modules/security.nix b/nixos/modules/security.nix deleted file mode 100644 index 358f27b..0000000 --- a/nixos/modules/security.nix +++ /dev/null @@ -1,62 +0,0 @@ -{ config, lib, ... }: - -{ - # Security-related system tweaks - - # Prevent replacing the running kernel without reboot. - security.protectKernelImage = true; - - # mount /tmp in ram. This makes temp file management faster - # on ssd systems, and volatile! Because it's wiped on reboot. - boot.tmp.useTmpfs = false; - boot.tmp.tmpfsSize = "80%"; - - # Purge /tmp on boot. (fallback option) - boot.tmp.cleanOnBoot = lib.mkDefault (!config.boot.tmp.useTmpfs); - - boot.kernel.sysctl = { - # The Magic SysRq key is a key combo that allows users connected to the - # system console of a Linux kernel to perform some low-level commands. - # Disable it, since we don't need it, and is a potential security concern. - "kernel.sysrq" = 0; - - ## TCP hardening - # Prevent bogus ICMP errors from filling up logs. - "net.ipv4.icmp_ignore_bogus_error_responses" = 1; - # Reverse path filtering causes the kernel to do source validation of - # packets received from all interfaces. This can mitigate IP spoofing. - "net.ipv4.conf.default.rp_filter" = 1; - "net.ipv4.conf.all.rp_filter" = 1; - # Do not accept IP source route packets (we're not a router) - "net.ipv4.conf.all.accept_source_route" = 0; - "net.ipv6.conf.all.accept_source_route" = 0; - # Don't send ICMP redirects (again, we're on a router) - "net.ipv4.conf.all.send_redirects" = 0; - "net.ipv4.conf.default.send_redirects" = 0; - # Refuse ICMP redirects (MITM mitigations) - "net.ipv4.conf.all.accept_redirects" = 0; - "net.ipv4.conf.default.accept_redirects" = 0; - "net.ipv4.conf.all.secure_redirects" = 0; - "net.ipv4.conf.default.secure_redirects" = 0; - "net.ipv6.conf.all.accept_redirects" = 0; - "net.ipv6.conf.default.accept_redirects" = 0; - # Protects against SYN flood attacks - "net.ipv4.tcp_syncookies" = 1; - # Incomplete protection again TIME-WAIT assassination - "net.ipv4.tcp_rfc1337" = 1; - - ## TCP optimization - # TCP Fast Open is a TCP extension that reduces network latency by packing - # data in the sender’s initial TCP SYN. Setting 3 = enable TCP Fast Open for - # both incoming and outgoing connections: - "net.ipv4.tcp_fastopen" = 3; - # Bufferbloat mitigations + slight improvement in throughput & latency - "net.ipv4.tcp_congestion_control" = "bbr"; - "net.core.default_qdisc" = "cake"; - }; - - boot.kernelModules = [ "tcp_bbr" ]; - - # Accept CA's ToS. - security.acme.acceptTerms = true; -} -- cgit 1.4.1