dotfiles

commit 25e7cd110057f4cb33d95977679f00cc3a3df7b3
parent 05f9a04ad013da9b53316da7e13c79f65eed938c
Author: maydayv7 <maydayv7@gmail.com>
Date:   Mon,  4 Dec 2023 13:15:21 +0530

feat: Apply Security Settings by default

+ Rename `inputs`
+ Update shell configuration

Diffstat:

18 files changed, 196 insertions(+), 212 deletions(-)
diff --git a/README.md b/README.md
@@ -423,12 +423,13 @@ You can navigate to the `README`s present in the various directories to know mor
 - Improve Syntax Formatting with `treefmt-nix` and drop `pre-commit-hooks`
 - Support declarative [Flatpak](https://flatpak.org/) application install
 - Update Nix to version 2.19
+- Enable Security & Hardening settings by default
 - Allow patching Default Package Channel
 - Separate `games` and `laptop` module
 - Show package delta using [`nvd`](https://gitlab.com/khumba/nvd)
 - Upgrade to GNOME 45
-  - Fix Emoji Support
-  - Update Extension
+  - Update Extensions
+- Fix Emoji Support
 - Drop `.templates`
 - Multiple Refactors
 
diff --git a/devices/Vortex/default.nix b/devices/Vortex/default.nix
@@ -15,7 +15,6 @@
     boot = "efi";
     cores = 8;
     filesystem = "advanced";
-    security = true;
     support = ["laptop" "mobile" "printer" "virtualisation"];
     modules = ["dell-inspiron-5509"];
     vm.android.enable = true;
diff --git a/devices/flake.nix b/devices/flake.nix
@@ -16,7 +16,7 @@ in {
     ## Virtual Machines ##
     vmConfigurations = with self;
       map.modules ./vm
-      (name: import name inputs.windows.lib legacyPackages."${head systems}");
+      (name: import name inputs.wfvm.lib legacyPackages."${head systems}");
 
     ## Install Media Configuration ##
     installMedia = let
diff --git a/flake.lock b/flake.lock
@@ -164,11 +164,11 @@
     "flake-compat_2": {
       "flake": false,
       "locked": {
-        "lastModified": 1673956053,
-        "narHash": "sha256-4gtG9iQuiKITOjNQQeQIpoIB6b16fm+504Ch3sNKLd8=",
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "35bb57c0c8d8b62bbfd284272c928ceb64ddbde9",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
         "type": "github"
       },
       "original": {
@@ -237,11 +237,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1698882062,
-        "narHash": "sha256-HkhafUayIqxXyHH1X8d9RDl1M2CkFgZLjKD3MzabiEo=",
+        "lastModified": 1701473968,
+        "narHash": "sha256-YcVE5emp1qQ8ieHUnxt1wCZCC3ZfAS+SRRWZ2TMda7E=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "8c9fa2545007b49a5db5f650ae91f227672c3877",
+        "rev": "34fed993f1674c8d06d58b37ce1e0fe5eebcb9f5",
         "type": "github"
       },
       "original": {
@@ -321,7 +321,7 @@
         "type": "github"
       }
     },
-    "home": {
+    "home-manager": {
       "inputs": {
         "nixpkgs": [
           "nixpkgs"
@@ -364,11 +364,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1700968077,
-        "narHash": "sha256-Lax+2g7G3Fe+ckMrHLYTl+97unbmNDmN1qS9MLBkxr4=",
+        "lastModified": 1701572887,
+        "narHash": "sha256-oCPwQZT0Inis4zcYhtFHUp7Rym1zglKPLDcRird35q8=",
         "owner": "Mic92",
         "repo": "nix-index-database",
-        "rev": "bd3aec0ecb0fdde863a7ed2c6caa220c47e22c07",
+        "rev": "41afa8d1c061beda68502bcc67f2788f3a77042b",
         "type": "github"
       },
       "original": {
@@ -485,7 +485,7 @@
         "gaming": "gaming",
         "generators": "generators",
         "hardware": "hardware",
-        "home": "home",
+        "home-manager": "home-manager",
         "impermanence": "impermanence",
         "index": "index",
         "nixpkgs": "nixpkgs_3",
@@ -496,8 +496,8 @@
         "systems": "systems_2",
         "unstable": "unstable",
         "utils": "utils_2",
-        "windows": "windows",
-        "wine": "wine"
+        "wfvm": "wfvm",
+        "windows": "windows"
       }
     },
     "sops": {
@@ -510,11 +510,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1700967639,
-        "narHash": "sha256-uuUwD/O1QcVk+TWPZFwl4ioUkC8iACj0jEXSyE/wGPI=",
+        "lastModified": 1701572436,
+        "narHash": "sha256-0anfOQqDend6kSuF8CmOSAZsiAS1nwOsin5VQukh6Q4=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "4be58d802693d7def8622ff34d36714f8db40371",
+        "rev": "8bca48cb9a12bbd8766f359ad00336924e91b7f7",
         "type": "github"
       },
       "original": {
@@ -535,7 +535,7 @@
         "base16-vim": "base16-vim",
         "flake-compat": "flake-compat",
         "home-manager": [
-          "home"
+          "home-manager"
         ],
         "nixpkgs": [
           "nixpkgs"
@@ -650,7 +650,7 @@
         "type": "github"
       }
     },
-    "windows": {
+    "wfvm": {
       "inputs": {
         "nixpkgs": [
           "nixpkgs"
@@ -670,7 +670,7 @@
         "url": "https://git.m-labs.hk/M-Labs/wfvm"
       }
     },
-    "wine": {
+    "windows": {
       "inputs": {
         "flake-compat": "flake-compat_2",
         "nixpkgs": [
@@ -678,11 +678,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1700931377,
-        "narHash": "sha256-99FrZnODbFF8LLWtYIeeomzknLaoR3QJVt/nUTZfdag=",
+        "lastModified": 1701473854,
+        "narHash": "sha256-yXQAHNaGxW48de95RP8HkOOyaaz7zP6JR3VM5YEH4rc=",
         "owner": "emmanuelrosa",
         "repo": "erosanix",
-        "rev": "2bf473495dcedbad0591ffb0ed08a2aaf8dab9b2",
+        "rev": "8cbe76f6417869794981eaf073e73bd2eda650af",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
@@ -89,7 +89,7 @@
 
     ## Feature Modules
     # User Home Manager
-    home = {
+    home-manager = {
       url = "github:nix-community/home-manager?ref=release-23.11";
       inputs.nixpkgs.follows = "nixpkgs";
     };
@@ -121,21 +121,21 @@
       url = "github:danth/stylix";
       inputs = {
         nixpkgs.follows = "nixpkgs";
-        home-manager.follows = "home";
+        home-manager.follows = "home-manager";
       };
     };
 
+    # Declarative Flatpak Wrapper
+    flatpak.url = "github:gmodena/nix-flatpak";
+
     # Windows VM Creator
-    windows = {
+    wfvm = {
       url = "git+https://git.m-labs.hk/M-Labs/wfvm";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    # Declarative Flatpak Wrapper
-    flatpak.url = "github:gmodena/nix-flatpak";
-
     # Windows Apps Wrapper
-    wine = {
+    windows = {
       url = "github:emmanuelrosa/erosanix";
       inputs.nixpkgs.follows = "unstable";
     };
diff --git a/modules/README.md b/modules/README.md
@@ -37,7 +37,6 @@ The `modules` directory contains custom-made pure Flakes-compatible configuratio
   - `filesystem`: Disk File System Choice - `"simple" / "advanced"` -
     - `persist`: System Files to Preserve across Reboots (while using `advanced` File System Layout)
   - `modules`: List of Hardware Configuration Modules imported from [`inputs.hardware`](https://github.com/nixos/nixos-hardware) - Ex. `[ "common-pc" ]`
-  - `security`: Enable Additional Security and Hardening Settings - `true / false`
   - `support`: List of Additional Supported Hardware - `[ "laptop" "mobile" "printer" "virtualisation" ]`
   - `vm`: Configure Virtualisation Support -
     - `android`: Enable Android Virtualisation
diff --git a/modules/apps/office.nix b/modules/apps/office.nix
@@ -9,7 +9,7 @@
   enable = builtins.elem "office" config.apps.list;
 in {
   ## Office Environment Configuration ##
-  imports = [inputs.wine.nixosModules.onlyoffice];
+  imports = [inputs.windows.nixosModules.onlyoffice];
 
   config = lib.mkIf enable {
     # Applications
diff --git a/modules/apps/wine.nix b/modules/apps/wine.nix
@@ -42,7 +42,7 @@ in {
           pkgs.callPackage name {
             inherit lib pkgs;
             wine = cfg.package;
-            build = inputs.wine.lib."${system}";
+            build = inputs.windows.lib."${system}";
           })));
   };
 }
diff --git a/modules/base/security.nix b/modules/base/security.nix
@@ -0,0 +1,104 @@
+{
+  lib,
+  pkgs,
+  ...
+}: {
+  ## Security & Hardening Settings ##
+  config = {
+    # Protocols
+    programs.firejail.enable = true;
+    security = {
+      protectKernelImage = true;
+      apparmor = {
+        enable = true;
+        killUnconfinedConfinables = true;
+        packages = [pkgs.apparmor-profiles];
+      };
+    };
+
+    boot = {
+      # Parameters
+      kernelParams = ["page_alloc.shuffle=1" "page_poison=1" "slub_debug=FZP"];
+
+      # Flags
+      kernel.sysctl = {
+        # Kernel
+        "kernel.ftrace_enabled" = false;
+        "kernel.kptr_restrict" = lib.mkOverride 500 2;
+        "kernel.sysrq" = 0;
+        "kernel.yama.ptrace_scope" = lib.mkOverride 500 1;
+
+        # Network
+        "net.core.bpf_jit_enable" = false;
+        "net.core.default_qdisc" = "cake";
+        "net.ipv4.conf.all.accept_redirects" = false;
+        "net.ipv4.conf.all.accept_source_route" = 0;
+        "net.ipv4.conf.all.log_martians" = true;
+        "net.ipv4.conf.all.rp_filter" = 1;
+        "net.ipv4.conf.all.secure_redirects" = false;
+        "net.ipv4.conf.all.send_redirects" = false;
+        "net.ipv4.conf.default.accept_redirects" = false;
+        "net.ipv4.conf.default.log_martians" = true;
+        "net.ipv4.conf.default.rp_filter" = 1;
+        "net.ipv4.conf.default.secure_redirects" = false;
+        "net.ipv4.conf.default.send_redirects" = false;
+        "net.ipv4.icmp_echo_ignore_broadcasts" = true;
+        "net.ipv4.icmp_ignore_bogus_error_responses" = 1;
+        "net.ipv4.tcp_congestion_control" = "bbr";
+        "net.ipv4.tcp_fastopen" = 3;
+        "net.ipv4.tcp_rfc1337" = 1;
+        "net.ipv4.tcp_syncookies" = 1;
+        "net.ipv6.conf.all.accept_redirects" = false;
+        "net.ipv6.conf.all.accept_source_route" = 0;
+        "net.ipv6.conf.default.accept_redirects" = false;
+      };
+
+      # Secure Modules
+      kernelModules = ["tcp_bbr"];
+
+      # Old & Obscure Modules
+      blacklistedKernelModules = [
+        # Network Protocols
+        "ax25"
+        "netrom"
+        "rose"
+
+        # Filesystems
+        "adfs"
+        "affs"
+        "befs"
+        "bfs"
+        "cramfs"
+        "efs"
+        "erofs"
+        "exofs"
+        "f2fs"
+        "freevxfs"
+        "hfs"
+        "hpfs"
+        "jfs"
+        "minix"
+        "nilfs2"
+        "ntfs"
+        "omfs"
+        "qnx4"
+        "qnx6"
+        "sysv"
+        "ufs"
+      ];
+    };
+
+    ## Block Junk Sites
+    networking.extraHosts =
+      builtins.readFile (pkgs.fetchurl {
+        # Shady Sites
+        url = "https://raw.githubusercontent.com/shreyasminocha/shady-hosts/fc9cc4020e80b3f87024c96178cba0f766b95e7a/hosts";
+        sha256 = "jbsEiIcOjoglqLeptHhwWhvL/p0PI3DVMdGCzSXFgNA=";
+      })
+      + builtins.readFile (pkgs.fetchurl {
+        # Crypto Scams
+        url = "https://raw.githubusercontent.com/MetaMask/eth-phishing-detect/3be0b9594f0bc6e3e699ee30cb2e809618539597/src/hosts.txt";
+        sha256 = "b3HvaLxnUJZOANUL/p+XPNvu9Aod9YLHYYtCZT5Lan0=";
+      });
+  };
+}
diff --git a/modules/configuration.nix b/modules/configuration.nix
@@ -75,7 +75,7 @@ in {
         inherit system;
         specialArgs = {
           inherit system util inputs files;
-          lib = with inputs; nixpkgs.lib // {inherit (home.lib) hm;};
+          lib = with inputs; nixpkgs.lib // {inherit (home-manager.lib) hm;};
         };
 
         modules = [
diff --git a/modules/hardware/filesystem.nix b/modules/hardware/filesystem.nix
@@ -20,6 +20,7 @@
     optional
     types
     ;
+
   inherit (config.hardware) filesystem;
 in {
   imports =
diff --git a/modules/hardware/security.nix b/modules/hardware/security.nix
@@ -1,117 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}: let
-  inherit (lib) mkEnableOption mkIf mkOverride;
-in {
-  options.hardware.security =
-    mkEnableOption "Enable Additional Security and Hardening Settings";
-
-  ## Security Settings ##
-  config = mkIf config.hardware.security {
-    warnings = [
-      ''
-        Additional Security Settings are Enabled
-        - These may cause Instability Issues or Sacrifice Performance
-      ''
-    ];
-
-    # Protocols
-    programs.firejail.enable = true;
-    security = {
-      protectKernelImage = true;
-      apparmor = {
-        enable = true;
-        killUnconfinedConfinables = true;
-        packages = [pkgs.apparmor-profiles];
-      };
-    };
-
-    boot = {
-      # Parameters
-      kernelParams = ["page_alloc.shuffle=1" "page_poison=1" "slub_debug=FZP"];
-
-      # Flags
-      kernel.sysctl = {
-        # Kernel
-        "kernel.ftrace_enabled" = false;
-        "kernel.kptr_restrict" = mkOverride 500 2;
-        "kernel.sysrq" = 0;
-        "kernel.yama.ptrace_scope" = mkOverride 500 1;
-
-        # Network
-        "net.core.bpf_jit_enable" = false;
-        "net.core.default_qdisc" = "cake";
-        "net.ipv4.conf.all.accept_redirects" = false;
-        "net.ipv4.conf.all.accept_source_route" = 0;
-        "net.ipv4.conf.all.log_martians" = true;
-        "net.ipv4.conf.all.rp_filter" = 1;
-        "net.ipv4.conf.all.secure_redirects" = false;
-        "net.ipv4.conf.all.send_redirects" = false;
-        "net.ipv4.conf.default.accept_redirects" = false;
-        "net.ipv4.conf.default.log_martians" = true;
-        "net.ipv4.conf.default.rp_filter" = 1;
-        "net.ipv4.conf.default.secure_redirects" = false;
-        "net.ipv4.conf.default.send_redirects" = false;
-        "net.ipv4.icmp_echo_ignore_broadcasts" = true;
-        "net.ipv4.icmp_ignore_bogus_error_responses" = 1;
-        "net.ipv4.tcp_congestion_control" = "bbr";
-        "net.ipv4.tcp_fastopen" = 3;
-        "net.ipv4.tcp_rfc1337" = 1;
-        "net.ipv4.tcp_syncookies" = 1;
-        "net.ipv6.conf.all.accept_redirects" = false;
-        "net.ipv6.conf.all.accept_source_route" = 0;
-        "net.ipv6.conf.default.accept_redirects" = false;
-      };
-
-      # Secure Modules
-      kernelModules = ["tcp_bbr"];
-
-      # Old & Obscure Modules
-      blacklistedKernelModules = [
-        # Network Protocols
-        "ax25"
-        "netrom"
-        "rose"
-
-        # Filesystems
-        "adfs"
-        "affs"
-        "befs"
-        "bfs"
-        "cramfs"
-        "efs"
-        "erofs"
-        "exofs"
-        "f2fs"
-        "freevxfs"
-        "hfs"
-        "hpfs"
-        "jfs"
-        "minix"
-        "nilfs2"
-        "ntfs"
-        "omfs"
-        "qnx4"
-        "qnx6"
-        "sysv"
-        "ufs"
-      ];
-    };
-
-    ## Block Junk Sites
-    networking.extraHosts =
-      builtins.readFile (pkgs.fetchurl {
-        # Shady Sites
-        url = "https://raw.githubusercontent.com/shreyasminocha/shady-hosts/fc9cc4020e80b3f87024c96178cba0f766b95e7a/hosts";
-        sha256 = "jbsEiIcOjoglqLeptHhwWhvL/p0PI3DVMdGCzSXFgNA=";
-      })
-      + builtins.readFile (pkgs.fetchurl {
-        # Crypto Scams
-        url = "https://raw.githubusercontent.com/MetaMask/eth-phishing-detect/3be0b9594f0bc6e3e699ee30cb2e809618539597/src/hosts.txt";
-        sha256 = "b3HvaLxnUJZOANUL/p+XPNvu9Aod9YLHYYtCZT5Lan0=";
-      });
-  };
-}
diff --git a/modules/nix/default.nix b/modules/nix/default.nix
@@ -14,18 +14,6 @@ in {
 
   ## Nix Settings ##
   config = {
-    # Utilities
-    user.persist.directories = [".cache/nix"] ++ optionals tools [".cache/manix"];
-    environment.systemPackages =
-      [pkgs.cachix]
-      ++ optionals tools (with pkgs; [
-        alejandra
-        manix
-        nodePackages.prettier
-        shellcheck
-        statix
-      ]);
-
     # Settings
     nix = {
       # Version
@@ -62,5 +50,17 @@ in {
         max-free = ${toString (10 * 1024 * 1024 * 1024)}
       '';
     };
+
+    # Utilities
+    user.persist.directories = [".cache/nix"] ++ optionals tools [".cache/manix"];
+    environment.systemPackages =
+      [pkgs.cachix]
+      ++ optionals tools (with pkgs; [
+        alejandra
+        manix
+        nodePackages.prettier
+        shellcheck
+        statix
+      ]);
   };
 }
diff --git a/modules/shell/bash.nix b/modules/shell/bash.nix
@@ -2,10 +2,8 @@
   config,
   lib,
   pkgs,
-  files,
   ...
-}:
-with files; let
+}: let
   inherit (builtins) any attrValues elem mapAttrs;
   inherit (config.user) settings;
   enable = any (value: elem "bash" value.shells) (attrValues settings);
@@ -39,23 +37,18 @@ in {
             "no_empty_cmd_completion"
           ];
 
-          # Initialization
-          initExtra =
-            ''
-              eval $(${pkgs.thefuck}/bin/thefuck --alias "fix")
-            ''
-            # Prompt
-            + ''
-              function _update_ps1() {
-                local old_exit_status=$?
-                eval $(${pkgs.powerline-go}/bin/powerline-go -error $old_exit_status -shell bash -eval -modules "host,cwd,exit,jobs,git" -newline)
-                return $old_exit_status
-              }
+          # Prompt
+          initExtra = ''
+            function _update_ps1() {
+              local old_exit_status=$?
+              eval $(${pkgs.powerline-go}/bin/powerline-go -error $old_exit_status -shell bash -eval -modules "host,cwd,exit,jobs,git" -newline)
+              return $old_exit_status
+            }
 
-              if [ "$TERM" != "linux" ]; then
-                PROMPT_COMMAND="_update_ps1;$PROMPT_COMMAND"
-              fi
-            '';
+            if [ "$TERM" != "linux" ]; then
+              PROMPT_COMMAND="_update_ps1;$PROMPT_COMMAND"
+            fi
+          '';
 
           # Command History
           historySize = 100000;
diff --git a/modules/shell/default.nix b/modules/shell/default.nix
@@ -7,7 +7,8 @@
   ...
 }:
 with files; let
-  inherit (lib) mkEnableOption mkIf mkMerge;
+  inherit (builtins) listToAttrs map;
+  inherit (lib) mkEnableOption mkBefore mkIf mkMerge nameValuePair;
 in {
   imports = util.map.module ./.;
 
@@ -42,39 +43,44 @@ in {
       ];
 
       ## Program Configuration
-      # Faster 'nix-shell'
-      services.lorri.enable = true;
+      services.lorri.enable = true; # Faster 'nix shell'
       programs = {
-        # Command Not Found Search
-        command-not-found.enable = true;
+        command-not-found.enable = true; # Command Not Found Search
 
         # Command Correction Helper
         thefuck = {
           enable = true;
-          alias = "fix";
+          alias = "fix"; # Use 'fix' to correct previous command
         };
       };
 
       user = {
         persist.directories = [".local/share/direnv"];
         home = {
-          programs = {
-            # DirENV Support
-            direnv = {
-              enable = true; # Load Shell Variables from '.envrc'
-              nix-direnv.enable = true;
-            };
+          programs =
+            listToAttrs (map (shell:
+              nameValuePair shell
+              {initExtra = mkBefore ''eval $(${pkgs.thefuck}/bin/thefuck --alias "fix")'';})
+            (util.map.module' ./.))
+            // {
+              hstr.enable = true; # Command History Browser
+
+              # DirENV Support
+              direnv = {
+                enable = true; # Load Shell Variables from '.envrc'
+                nix-direnv.enable = true;
+              };
 
-            # Bat Configuration
-            bat = {
-              enable = true;
-              config = {
-                style = "full";
-                italic-text = "always";
-                map-syntax = [".ignore:Git Ignore"];
+              # Bat Configuration
+              bat = {
+                enable = true;
+                config = {
+                  style = "full";
+                  italic-text = "always";
+                  map-syntax = [".ignore:Git Ignore"];
+                };
               };
             };
-          };
 
           # Neofetch
           home.file.".config/neofetch/config.conf".text = fetch;
@@ -88,8 +94,9 @@ in {
             # Programs
             cat = "bat";
             colors = "${scripts.colors}";
+            grep = "grep --color";
             edit = "sudo $EDITOR";
-            ls = "eza -b -h -l -F --octal-permissions --icons --time-style iso";
+            l = "eza -b -h -l -F --octal-permissions --icons --time-style iso";
             sike = "neofetch";
           };
         };
diff --git a/modules/shell/zsh.nix b/modules/shell/zsh.nix
@@ -33,10 +33,7 @@ in {
           syntaxHighlighting.enable = true;
 
           # Initialization
-          initExtraBeforeCompInit = ''
-            source ~/.p10k.zsh
-            eval $(${pkgs.thefuck}/bin/thefuck --alias "fix")
-          '';
+          initExtraBeforeCompInit = "source ~/.p10k.zsh";
 
           # Keybindings
           initExtra = ''
diff --git a/modules/user/default.nix b/modules/user/default.nix
@@ -28,7 +28,7 @@
     merge = _: getValues;
   };
 in {
-  imports = util.map.module ./. ++ [inputs.home.nixosModules.home-manager];
+  imports = util.map.module ./. ++ [inputs.home-manager.nixosModules.home-manager];
 
   options = {
     # Global Home Manager Configuration
diff --git a/packages/flake.nix b/packages/flake.nix
@@ -46,9 +46,9 @@ in {
                 custom = self.packages."${system}";
                 unstable = import unstable {inherit system;};
 
-                wine = wine.packages."${system}";
                 gaming = gaming.packages."${system}";
                 generators = generators.packages."${system}".default;
+                wine = windows.packages."${system}";
               })
             ];
         };