Add given password for hosts/patate/credential.secret to store.

[julm/julm-nix.git] / nixos / profiles / security.nix

diff --git a/nixos/profiles/security.nix b/nixos/profiles/security.nix
index 34fe0c1d32e3988419d410cae034a5cd0f156301..1935b56dfa6ec9ba80a4651ed3b3601a19bc4af3 100644 (file)
--- a/nixos/profiles/security.nix
+++ b/nixos/profiles/security.nix
@@ -7,11 +7,23 @@ with lib;
   #boot.kernelPackages = pkgs.linuxPackages_latest_hardened;
   #environment.memoryAllocator.provider = "libc";
   nix.settings.allowed-users = [ "@users" ];
+  /*
+    nix.settings.substituters = [
+    "https://nix-community.cachix.org"
+    ];
+    nix.settings.trusted-public-keys = [
+    "nix-community.cachix.org:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+    ];
+  */
+  nix.settings.trusted-users = [
+    "root"
+    "@wheel"
+  ];
   networking.firewall.pingLimit = "--limit 60/minute --limit-burst 5";
   security.allowSimultaneousMultithreading = false;
-  security.apparmor.enable = lib.mkDefault true;
+  security.apparmor.enable = mkDefault true;
   security.forcePageTableIsolation = true;
-  security.lockKernelModules = lib.mkDefault true;
+  security.lockKernelModules = mkDefault true;
   security.protectKernelImage = true;
   security.virtualisation.flushL1DataCache = "always";
   # Only allow members of the wheel group to execute sudo by setting
@@ -114,8 +126,8 @@ with lib;
       "net.ipv4.tcp_fack" = 0;
     */
     # Generate a random IPv6 address
-    "net.ipv6.conf.all.use_tempaddr" = lib.mkForce 2;
-    "net.ipv6.conf.default.use_tempaddr" = lib.mkForce 2;
+    "net.ipv6.conf.all.use_tempaddr" = mkForce 2;
+    "net.ipv6.conf.default.use_tempaddr" = mkForce 2;
     # Restricts usage of ptrace to only processes
     # with the CAP_SYS_PTRACE capability
     "kernel.yama.ptrace_scope" = 2;
@@ -147,7 +159,7 @@ with lib;
     SystemMaxUse=100M
   '';
   systemd.coredump = {
-    enable = lib.mkDefault false;
+    enable = mkDefault false;
     extraConfig = ''
       Compress=true
       MaxUse=1024M
@@ -155,7 +167,6 @@ with lib;
     '';
   };
   services.openssh = {
-    openFirewall = lib.mkDefault false;
     # Avoid TOFU MITM by providing well known public keys here.
     knownHosts = {
       "git.sr.ht".hostNames = [ "git.sr.ht" ];
@@ -169,7 +180,7 @@ with lib;
     };
     openFirewall = mkDefault false;
     settings = {
-      KbdInteractiveAuthentication = lib.mkDefault false;
+      KbdInteractiveAuthentication = mkDefault false;
       # Use key exchange algorithms recommended by `nixpkgs#ssh-audit`
       KexAlgorithms = [
         "curve25519-sha256"
@@ -181,8 +192,8 @@ with lib;
       PasswordAuthentication = false;
       # Remove any remote gpg-agent's socket.
       StreamLocalBindUnlink = true;
-      UseDns = lib.mkDefault false;
-      X11Forwarding = lib.mkDefault false;
+      UseDns = mkDefault false;
+      X11Forwarding = mkDefault false;
     };
   };
 }