hosts/carotte/security.nix

   1 { lib, ... }:
   2 {
   3   security.lockKernelModules = false;
   4   security.virtualisation.flushL1DataCache = lib.mkForce null;
   5   security.gnupg.agent = {
   6     keyring."C7BCEA3D090956E7D51E94ADFF53191D9FA89552" = {
   7       passwordGpg = "gnupg/root.gpg";
   8       passwordFile = "/root/.gnupg.C7BCEA3D090956E7D51E94ADFF53191D9FA89552.txt";
   9     };
  10   };
  11   services.openssh.extraConfig = ''
  12     # This is for removing remote gpg-agent's socket
  13     StreamLocalBindUnlink yes
  14   '';
  15 }