hd/cfg
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

major refactor

Browse source
This commit is contained in:
Henri Dohmen 2025-12-23 23:05:32 +01:00
parent 20472f8d1b
commit d778875a1b
Signed by: hd
GPG key ID: AB79213B044674AE
32 changed files with 495 additions and 428 deletions
Download patch file Download diff file Expand all files Collapse all files

104
mod/common/security.nix Normal file
View file

@ -0,0 +1,104 @@
{
config,
lib,
pkgs,
...
}:
with lib;
{
config = mkIf config.hd.common.security.enable {
boot = {
kernel.sysctl = {
"net.ipv4.icmp_ignore_bogus_error_responses" = 1;
"net.ipv4.conf.default.rp_filter" = 1;
"net.ipv4.conf.all.rp_filter" = 1;
"net.ipv4.conf.all.accept_source_route" = 0;
"net.ipv6.conf.all.accept_source_route" = 0;
"net.ipv4.conf.all.send_redirects" = 0;
"net.ipv4.conf.default.send_redirects" = 0;
"net.ipv4.conf.all.accept_redirects" = 0;
"net.ipv4.conf.default.accept_redirects" = 0;
"net.ipv4.conf.all.secure_redirects" = 0;
"net.ipv4.conf.default.secure_redirects" = 0;
"net.ipv6.conf.all.accept_redirects" = 0;
"net.ipv6.conf.default.accept_redirects" = 0;
"net.ipv4.tcp_syncookies" = 1;
"net.ipv4.tcp_rfc1337" = 1;
"net.ipv4.tcp_fastopen" = 3;
"kernel.kptr_restrict" = 2;
"randomize_kstack_offset" = "on";
"spec_store_bypass_disable" = "on";
};
# otherwise /tmp is on disk. This *may* be problematic as nix
# builds in /tmp but I think my swap is large enough...
tmp.useTmpfs = lib.mkDefault true;
tmp.cleanOnBoot = lib.mkDefault (!config.boot.tmp.useTmpfs);
kernelParams = [
"init_on_free=1" # zero freed pages
"page_alloc.shuffle=1"
"page_poison=1"
"slab_nomerge"
# "slub_debug=FZ" # disabled due to https://lore.kernel.org/all/20210601182202.3011020-5-swboyd@chromium.org/T/#u
"vsyscall=none" # diable virtual syscalls
];
blacklistedKernelModules = [
"ax25"
"netrom"
"rose"
"adfs"
"affs"
"bfs"
"befs"
"cramfs"
"efs"
"erofs"
"exofs"
"freevxfs"
"f2fs"
"hfs"
"hpfs"
"jfs"
"minix"
"nilfs2"
"ntfs"
"omfs"
"qnx4"
"qnx6"
"sysv"
"ufs"
];
};
networking.firewall.enable = true;
security = {
protectKernelImage = true;
forcePageTableIsolation = true;
apparmor.enable = true;
apparmor.killUnconfinedConfinables = true;
sudo.enable = false;
doas = {
enable = true;
extraRules = [
{
groups = [ "wheel" ];
persist = true;
keepEnv = true;
}
];
};
pki.certificateFiles = [ ../../pki/ca.cert ];
};
};
}