From bc4039ae8c86f794cece9d9ceb43b838e61cf445 Mon Sep 17 00:00:00 2001 From: sefidel Date: Mon, 21 Aug 2023 19:20:36 +0900 Subject: chore: nixos/modules -> modules --- nixos/default.nix | 6 +-- nixos/modules/cachix/caches/helix.nix | 12 ------ nixos/modules/cachix/caches/nix-community.nix | 12 ------ nixos/modules/cachix/default.nix | 13 ------ nixos/modules/default.nix | 6 --- nixos/modules/flakes.nix | 35 --------------- nixos/modules/nix.nix | 34 --------------- nixos/modules/security.nix | 62 --------------------------- 8 files changed, 3 insertions(+), 177 deletions(-) delete mode 100644 nixos/modules/cachix/caches/helix.nix delete mode 100644 nixos/modules/cachix/caches/nix-community.nix delete mode 100644 nixos/modules/cachix/default.nix delete mode 100644 nixos/modules/default.nix delete mode 100644 nixos/modules/flakes.nix delete mode 100644 nixos/modules/nix.nix delete mode 100644 nixos/modules/security.nix (limited to 'nixos') diff --git a/nixos/default.nix b/nixos/default.nix index 611aa1d..ed40dad 100644 --- a/nixos/default.nix +++ b/nixos/default.nix @@ -5,8 +5,8 @@ name = "alpha"; nixpkgs = unstable; extraModules = [ - ./modules/security.nix - ./modules/cachix + ../modules/security.nix + ../modules/cachix inputs.sops-nix.nixosModules.sops ]; }; @@ -16,7 +16,7 @@ system = "aarch64-linux"; nixpkgs = unstable-small; extraModules = [ - ./modules/security.nix + ../modules/security.nix ]; }; diff --git a/nixos/modules/cachix/caches/helix.nix b/nixos/modules/cachix/caches/helix.nix deleted file mode 100644 index 7783a96..0000000 --- a/nixos/modules/cachix/caches/helix.nix +++ /dev/null @@ -1,12 +0,0 @@ -{ config, lib, ... }: - -{ - nix.settings = { - substituters = [ - "https://helix.cachix.org" - ]; - trusted-public-keys = [ - "helix.cachix.org-1:ejp9KQpR1FBI2onstMQ34yogDm4OgU2ru6lIwPvuCVs=" - ]; - }; -} diff --git a/nixos/modules/cachix/caches/nix-community.nix b/nixos/modules/cachix/caches/nix-community.nix deleted file mode 100644 index d323939..0000000 --- a/nixos/modules/cachix/caches/nix-community.nix +++ /dev/null @@ -1,12 +0,0 @@ -{ config, lib, ... }: - -{ - nix.settings = { - substituters = [ - "https://nix-community.cachix.org" - ]; - trusted-public-keys = [ - "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" - ]; - }; -} diff --git a/nixos/modules/cachix/default.nix b/nixos/modules/cachix/default.nix deleted file mode 100644 index 9dd55b5..0000000 --- a/nixos/modules/cachix/default.nix +++ /dev/null @@ -1,13 +0,0 @@ -{ config, pkgs, lib, ... }: -let - folder = ./caches; - toImport = name: value: folder + ("/" + name); - filterCaches = key: value: value == "regular" && lib.hasSuffix ".nix" key; - imports = lib.mapAttrsToList toImport (lib.filterAttrs filterCaches (builtins.readDir folder)); -in -{ - inherit imports; - nix.settings.substituters = [ "https://cache.nixos.org/" ]; - - environment.systemPackages = [ pkgs.cachix ]; -} diff --git a/nixos/modules/default.nix b/nixos/modules/default.nix deleted file mode 100644 index df11f91..0000000 --- a/nixos/modules/default.nix +++ /dev/null @@ -1,6 +0,0 @@ -{ - cachix = import ./cachix; - flakes = import ./flakes.nix; - nix = import ./nix.nix; - security = import ./security.nix; -} diff --git a/nixos/modules/flakes.nix b/nixos/modules/flakes.nix deleted file mode 100644 index 76f89f3..0000000 --- a/nixos/modules/flakes.nix +++ /dev/null @@ -1,35 +0,0 @@ -{ config, pkgs, unstable, unstable-small, nixpkgs-2211, lib, ... }: - -let - base = "/etc/nixpkgs/channels"; - nixpkgsPath = "${base}/nixpkgs"; - nixpkgsSmallPath = "${base}/nixpkgsSmall"; - nixpkgs2211Path = "${base}/nixpkgs2211"; -in -{ - options.nix.flakes.enable = lib.mkEnableOption "nix flakes"; - - config = lib.mkIf config.nix.flakes.enable { - nix = { - package = pkgs.nixUnstable; - experimentalFeatures = "nix-command flakes"; - - registry.nixpkgs.flake = unstable; - registry.nixpkgsSmall.flake = unstable-small; - registry.nixpkgs2211.flake = nixpkgs-2211; - - nixPath = [ - "nixpkgs=${nixpkgsPath}" - "nixpkgsSmall=${nixpkgsSmallPath}" - "nixpkgs2211=${nixpkgs2211Path}" - "/nix/var/nix/profiles/per-user/root/channels" - ]; - }; - - systemd.tmpfiles.rules = [ - "L+ ${nixpkgsPath} - - - - ${unstable}" - "L+ ${nixpkgsSmallPath} - - - - ${unstable-small}" - "L+ ${nixpkgs2211Path} - - - - ${nixpkgs-2211}" - ]; - }; -} diff --git a/nixos/modules/nix.nix b/nixos/modules/nix.nix deleted file mode 100644 index 8396739..0000000 --- a/nixos/modules/nix.nix +++ /dev/null @@ -1,34 +0,0 @@ -{ config, lib, ... }: - -let - allowed = config.nix.allowedUnfree; -in -{ - options.nix = { - experimentalFeatures = lib.mkOption { - type = lib.types.separatedString " "; - default = ""; - description = '' - Enables experimental features - ''; - }; - - allowedUnfree = lib.mkOption { - type = lib.types.listOf lib.types.str; - default = [ ]; - description = '' - Allows for unfree packages by their name. - ''; - }; - }; - - config = lib.mkMerge [ - (lib.mkIf (config.nix.experimentalFeatures != "") { nix.extraOptions = "experimental-features = ${config.nix.experimentalFeatures}"; }) - (lib.mkIf (allowed != [ ]) { nixpkgs.config.allowUnfreePredicate = (pkg: __elem (lib.getName pkg) allowed); }) - { nix.settings.auto-optimise-store = lib.mkDefault true; } - { - nix.gc.automatic = lib.mkDefault true; - nix.gc.options = lib.mkDefault "--delete-older-than 10d"; - } - ]; -} diff --git a/nixos/modules/security.nix b/nixos/modules/security.nix deleted file mode 100644 index 358f27b..0000000 --- a/nixos/modules/security.nix +++ /dev/null @@ -1,62 +0,0 @@ -{ config, lib, ... }: - -{ - # Security-related system tweaks - - # Prevent replacing the running kernel without reboot. - security.protectKernelImage = true; - - # mount /tmp in ram. This makes temp file management faster - # on ssd systems, and volatile! Because it's wiped on reboot. - boot.tmp.useTmpfs = false; - boot.tmp.tmpfsSize = "80%"; - - # Purge /tmp on boot. (fallback option) - boot.tmp.cleanOnBoot = lib.mkDefault (!config.boot.tmp.useTmpfs); - - boot.kernel.sysctl = { - # The Magic SysRq key is a key combo that allows users connected to the - # system console of a Linux kernel to perform some low-level commands. - # Disable it, since we don't need it, and is a potential security concern. - "kernel.sysrq" = 0; - - ## TCP hardening - # Prevent bogus ICMP errors from filling up logs. - "net.ipv4.icmp_ignore_bogus_error_responses" = 1; - # Reverse path filtering causes the kernel to do source validation of - # packets received from all interfaces. This can mitigate IP spoofing. - "net.ipv4.conf.default.rp_filter" = 1; - "net.ipv4.conf.all.rp_filter" = 1; - # Do not accept IP source route packets (we're not a router) - "net.ipv4.conf.all.accept_source_route" = 0; - "net.ipv6.conf.all.accept_source_route" = 0; - # Don't send ICMP redirects (again, we're on a router) - "net.ipv4.conf.all.send_redirects" = 0; - "net.ipv4.conf.default.send_redirects" = 0; - # Refuse ICMP redirects (MITM mitigations) - "net.ipv4.conf.all.accept_redirects" = 0; - "net.ipv4.conf.default.accept_redirects" = 0; - "net.ipv4.conf.all.secure_redirects" = 0; - "net.ipv4.conf.default.secure_redirects" = 0; - "net.ipv6.conf.all.accept_redirects" = 0; - "net.ipv6.conf.default.accept_redirects" = 0; - # Protects against SYN flood attacks - "net.ipv4.tcp_syncookies" = 1; - # Incomplete protection again TIME-WAIT assassination - "net.ipv4.tcp_rfc1337" = 1; - - ## TCP optimization - # TCP Fast Open is a TCP extension that reduces network latency by packing - # data in the sender’s initial TCP SYN. Setting 3 = enable TCP Fast Open for - # both incoming and outgoing connections: - "net.ipv4.tcp_fastopen" = 3; - # Bufferbloat mitigations + slight improvement in throughput & latency - "net.ipv4.tcp_congestion_control" = "bbr"; - "net.core.default_qdisc" = "cake"; - }; - - boot.kernelModules = [ "tcp_bbr" ]; - - # Accept CA's ToS. - security.acme.acceptTerms = true; -} -- cgit 1.4.1