commit 37aa2836654c2ba34f0434e2b7b8d826bb5ec742
parent ee1e39329537c75df3f5fb5e780a8b65fbf87252
Author: maydayv7 <maydayv7@gmail.com>
Date: Wed, 1 Jul 2026 23:16:24 +0530
feat: Sandbox Firefox
Diffstat:
17 files changed, 484 insertions(+), 219 deletions(-)
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,7 @@
### June
+- Sandbox Firefox using [NixPak](https://github.com/nixpak/nixpak)
- Add Zed Editor
- Rename `nixos` script to `os` and adopt [`nh`](https://github.com/nix-community/nh)
- Use `micro` as default editor
diff --git a/files/_module.nix b/files/_module.nix
@@ -4,8 +4,6 @@
...
}: let
inherit (config) util;
- inherit (util) build map;
- inherit (builtins) fromJSON readFile;
in {
flake.files = rec {
# File Paths
@@ -29,7 +27,7 @@ in {
repl = ./repl.nix;
# ASCII Art
- ascii = map.files {
+ ascii = util.map.files {
directory = ./ascii;
extension = "";
recursive = true;
@@ -43,18 +41,18 @@ in {
'';
# Base16 Color Schemes
- colors = map.files {
+ colors = util.map.files {
directory = ./colors;
extension = ".yaml";
};
# Fastfetch
- fetch = readFile ./fastfetch.jsonc;
+ fetch = builtins.readFile ./fastfetch.jsonc;
# Geany Text Editor
- geany = map.files {
+ geany = util.map.files {
directory = ./geany;
- apply = readFile;
+ apply = builtins.readFile;
extension = ".conf";
};
@@ -62,14 +60,14 @@ in {
git.hooks = ./git/hooks;
# Gitea Code Hosting
- gitea = map.files {
+ gitea = util.map.files {
directory = ./gitea;
- apply = readFile;
+ apply = builtins.readFile;
extension = ".css";
};
# GNOME Desktop
- gnome = map.files {
+ gnome = util.map.files {
directory = ./gnome;
extension = ".json";
};
@@ -78,33 +76,33 @@ in {
hyprland = {
shaders = ./hyprland/shaders;
noctalia = ./hyprland/noctalia;
- pypr = readFile ./hyprland/pypr.toml;
- kebihelp = readFile ./hyprland/kebihelp.json;
+ pypr = builtins.readFile ./hyprland/pypr.toml;
+ kebihelp = builtins.readFile ./hyprland/kebihelp.json;
};
# Pictures
- images = map.files {
+ images = util.map.files {
directory = ./images;
extension = ".png";
};
# Password Manager
- keepassxc = readFile ./keepassxc.ini;
+ keepassxc = builtins.readFile ./keepassxc.ini;
# Nano Text Editor
- nano = readFile ./nanorc;
+ nano = builtins.readFile ./nanorc;
# PcmanFM File Manager
- pcmanfm = readFile ./pcmanfm.conf;
+ pcmanfm = builtins.readFile ./pcmanfm.conf;
# Custom Proprietary Files
proprietary = inputs.proprietary.files;
inherit (proprietary) wallpapers;
# Bash Scripts
- scripts = map.files {
+ scripts = util.map.files {
directory = ../scripts;
- apply = build.script;
+ apply = util.build.script;
extension = ".sh";
};
@@ -112,9 +110,9 @@ in {
templates = ./templates;
# Visual Studio Code Editor
- vscode = map.files {
+ vscode = util.map.files {
directory = ./vscode;
- apply = file: fromJSON (readFile file);
+ apply = file: builtins.fromJSON (builtins.readFile file);
extension = ".json";
};
@@ -122,6 +120,13 @@ in {
website = ../site;
# YouTube
- youtube = readFile ./ytmusic.json;
+ youtube = builtins.readFile ./ytmusic.json;
+
+ # Zed Editor
+ zed = util.map.files {
+ directory = ./zed;
+ apply = file: builtins.fromJSON (builtins.readFile file);
+ extension = ".json";
+ };
};
}
diff --git a/files/vscode/settings.json b/files/vscode/settings.json
@@ -42,8 +42,17 @@
"scm.repositories.visible": 7,
"nix.enableLanguageServer": true,
"nix.serverPath": "nixd",
+ "nix.hiddenLanguageServerErrors": ["textDocument/definition"],
"nix.serverSettings": {
"nixd": {
+ "nixpkgs": {
+ "expr": "import (builtins.getFlake \"/etc/nixos\").inputs.nixpkgs { }"
+ },
+ "options": {
+ "nixos": {
+ "expr": "let f = builtins.getFlake \"/etc/nixos\"; h = builtins.replaceStrings [\"\\n\"] [\"\"] (builtins.readFile /etc/hostname); in f.nixosConfigurations.${h}.options"
+ }
+ },
"formatting": {
"command": ["alejandra"]
}
diff --git a/files/zed/keymap.json b/files/zed/keymap.json
@@ -0,0 +1,17 @@
+[
+ {
+ "context": "Workspace",
+ "bindings": {
+ "ctrl-/": "command_palette::Toggle",
+ "alt-t": "terminal_panel::ToggleFocus",
+ "ctrl-shift-t": "workspace::NewTerminal"
+ }
+ },
+ {
+ "context": "Editor",
+ "bindings": {
+ "ctrl-d": "editor::DeleteLine",
+ "ctrl-'": "editor::ToggleComments"
+ }
+ }
+]
diff --git a/files/zed/settings.json b/files/zed/settings.json
@@ -0,0 +1,109 @@
+{
+ "cli_default_open_behavior": "existing_window",
+ "disable_ai": true,
+ "agent": {
+ "button": false,
+ "favorite_models": [],
+ "model_parameters": []
+ },
+ "auto_update": false,
+ "edit_predictions": {
+ "provider": "none"
+ },
+ "features": {
+ "edit_prediction_provider": "none"
+ },
+ "telemetry": {
+ "diagnostics": false,
+ "metrics": false
+ },
+
+ "ui_font_size": 16,
+ "buffer_font_size": 15,
+
+ "window_decorations": "client",
+ "title_bar": {
+ "button_layout": "minimize,close",
+ "show_branch_status_icon": true,
+ "show_branch_name": true,
+ "show_menus": false
+ },
+ "tab_bar": {
+ "show_pinned_tabs_in_separate_row": true
+ },
+ "tabs": {
+ "file_icons": true,
+ "git_status": true
+ },
+ "git_panel": {
+ "show_count_badge": false,
+ "file_icons": false,
+ "dock": "left"
+ },
+ "project_panel": {
+ "git_status_indicator": true,
+ "dock": "left"
+ },
+ "minimap": {
+ "current_line_highlight": "all",
+ "thumb_border": "right_open",
+ "thumb": "always",
+ "show": "auto"
+ },
+ "scrollbar": {
+ "show": "auto"
+ },
+
+ "colorize_brackets": true,
+ "indent_guides": {
+ "background_coloring": "disabled",
+ "coloring": "fixed"
+ },
+ "cursor_blink": true,
+ "cursor_shape": "bar",
+ "scroll_beyond_last_line": "vertical_scroll_margin",
+ "which_key": {
+ "enabled": true
+ },
+
+ "autosave": "on_window_change",
+ "close_on_file_delete": true,
+ "when_closing_with_no_tabs": "close_window",
+ "format_on_save": "on",
+ "ensure_final_newline_on_save": false,
+ "remove_trailing_whitespace_on_save": true,
+ "use_smartcase_search": true,
+
+ "terminal": {
+ "show_count_badge": false,
+ "cursor_shape": "bar",
+ "shell": "system"
+ },
+
+ "languages": {
+ "Nix": {
+ "language_servers": ["nixd"],
+ "formatter": {
+ "external": {
+ "command": "alejandra",
+ "arguments": ["-q", "-"]
+ }
+ }
+ }
+ },
+
+ "lsp": {
+ "nixd": {
+ "settings": {
+ "nixpkgs": {
+ "expr": "import (builtins.getFlake \"/etc/nixos\").inputs.nixpkgs { }"
+ },
+ "options": {
+ "nixos": {
+ "expr": "let f = builtins.getFlake \"/etc/nixos\"; h = builtins.replaceStrings [\"\\n\"] [\"\"] (builtins.readFile /etc/hostname); in f.nixosConfigurations.${h}.options"
+ }
+ }
+ }
+ }
+ }
+}
diff --git a/flake.lock b/flake.lock
@@ -494,6 +494,31 @@
"type": "github"
}
},
+ "hercules-ci-effects": {
+ "inputs": {
+ "flake-parts": [
+ "nixpak",
+ "flake-parts"
+ ],
+ "nixpkgs": [
+ "nixpak",
+ "nixpkgs"
+ ]
+ },
+ "locked": {
+ "lastModified": 1781499420,
+ "narHash": "sha256-vy0EiuiLRKWbXYOqdEKoy5ImlbHcdMC52x9BcC/MwQ8=",
+ "owner": "hercules-ci",
+ "repo": "hercules-ci-effects",
+ "rev": "86c7c78a840b44b1a0a5cbc7e9baa0154c0d0f3f",
+ "type": "github"
+ },
+ "original": {
+ "owner": "hercules-ci",
+ "repo": "hercules-ci-effects",
+ "type": "github"
+ }
+ },
"home-manager": {
"inputs": {
"nixpkgs": [
@@ -1658,6 +1683,30 @@
"type": "github"
}
},
+ "nixpak": {
+ "inputs": {
+ "flake-parts": [
+ "flake-parts"
+ ],
+ "hercules-ci-effects": "hercules-ci-effects",
+ "nixpkgs": [
+ "nixpkgs"
+ ]
+ },
+ "locked": {
+ "lastModified": 1781749433,
+ "narHash": "sha256-Pb2+bL5WRZLIzb/NMdjHEe9UBcU/yGfb1QWlyzyMTic=",
+ "owner": "nixpak",
+ "repo": "nixpak",
+ "rev": "be97295fa81fe743b9753449143dd4931e51d63c",
+ "type": "github"
+ },
+ "original": {
+ "owner": "nixpak",
+ "repo": "nixpak",
+ "type": "github"
+ }
+ },
"nixpkgs": {
"locked": {
"lastModified": 1767892417,
@@ -1861,6 +1910,7 @@
"minecraft": "minecraft",
"niri": "niri",
"nixcord": "nixcord",
+ "nixpak": "nixpak",
"nixpkgs": [
"stable"
],
diff --git a/flake.nix b/flake.nix
@@ -137,6 +137,15 @@
inputs.nixpkgs.follows = "nixpkgs";
};
+ # Application Sandboxing
+ nixpak = {
+ url = "github:nixpak/nixpak";
+ inputs = {
+ nixpkgs.follows = "nixpkgs";
+ flake-parts.follows = "flake-parts";
+ };
+ };
+
# Declarative Flatpak Wrapper
flatpak.url = "github:gmodena/nix-flatpak/latest";
diff --git a/modules/apps/zed.nix b/modules/apps/zed.nix
@@ -1,16 +1,13 @@
## Zed Editor ##
{config, ...}: let
inherit (config) util;
+ inherit (config.flake) files;
in {
flake.modules.homeManager.zed = {
- lib,
+ config,
pkgs,
- osConfig ? {},
...
- }: let
- isGnome = osConfig.services.desktopManager.gnome.enable or false;
- isWM = (osConfig.programs.hyprland.enable or false) || (osConfig.programs.niri.enable or false);
- in {
+ }: {
xdg.mimeApps = let
mime = util.build.mime {
code = ["dev.zed.Zed.desktop"];
@@ -22,79 +19,23 @@ in {
associations.added = mime;
};
- home.persist.directories = [".config/zed"];
+ home.persist.directories = [
+ ".config/zed"
+ ".local/share/zed"
+ ];
+
programs.zed-editor = {
enable = true;
package = pkgs.zed-editor;
- extraPackages = with pkgs; [
- nixd
- alejandra
- ];
- ## Settings
- userSettings = lib.mkMerge [
- {
- # Editor
- "format_on_save" = "on";
- "ensure_final_newline_on_save" = true;
- "remove_trailing_whitespace_on_save" = true;
- "cursor_blink" = true;
- "cursor_shape" = "bar";
- "scrollbar"."show" = "auto";
- "use_smartcase_search" = true;
- "autosave" = "on_window_change";
- "close_on_file_delete" = true;
- "when_closing_with_no_tabs" = "close_window";
-
- # Terminal
- "terminal"."cursor_shape" = "bar";
-
- # Telemetry
- "auto_update" = false;
- "features"."edit_prediction_provider" = "none";
- "telemetry" = {
- "diagnostics" = false;
- "metrics" = false;
- };
-
- # Icons
- "icon_theme" = lib.mkDefault "Material Icon Theme";
-
- # Formatters
- "languages"."Nix" = {
- "language_servers" = ["nixd"];
- "formatter"."external" = {
- "command" = "alejandra";
- "arguments" = ["-q" "-"];
- };
- };
- }
- (lib.mkIf isGnome {
- "terminal"."shell"."program" = "ghostty";
- })
- (lib.mkIf isWM {
- "terminal"."shell"."program" = "kitty";
- })
- ];
-
- # Keymaps
- userKeymaps = [
- {
- context = "Workspace";
- bindings = {
- "ctrl-/" = "command_palette::Toggle";
- "alt-t" = "terminal_panel::ToggleFocus";
- "ctrl-shift-t" = "workspace::NewTerminal";
- };
- }
- {
- context = "Editor";
- bindings = {
- "ctrl-d" = "editor::DeleteLine";
- "ctrl-'" = "editor::ToggleComments";
- };
- }
- ];
+ # Settings
+ userSettings =
+ files.zed.settings
+ // (with config.stylix.fonts; {
+ "ui_font_family" = sansSerif.name;
+ "buffer_font_family" = monospace.name;
+ });
+ userKeymaps = files.zed.keymap;
## Extensions
extensions = [
@@ -112,6 +53,22 @@ in {
"git-firefly" # Git
"material-icon-theme" # File Icons
];
+
+ extraPackages = with pkgs; [
+ nixd
+ alejandra
+ clang-tools # C/C++
+ rust-analyzer # Rust
+ gopls # Go
+ basedpyright # Python
+ bash-language-server # Bash
+ vscode-langservers-extracted # HTML/CSS/JSON
+ yaml-language-server # YAML
+ marksman # Markdown
+ taplo # TOML
+ texlab # LaTeX
+ dockerfile-language-server # Docker
+ ];
};
};
}
diff --git a/modules/core/home-manager.nix b/modules/core/home-manager.nix
@@ -20,6 +20,7 @@ in {
}:
inputs.home-manager.lib.homeManagerConfiguration {
pkgs = config.flake.legacyPackages.${system};
+ extraSpecialArgs = {inherit inputs;};
modules =
[
module
diff --git a/modules/desktop/_wm/misc.nix b/modules/desktop/_wm/misc.nix
@@ -1,6 +1,6 @@
## Miscellaneous
_: {
- home = _: {
+ home = {lib, ...}: {
# GTK Apps
dconf.settings."org/gnome/desktop/wm/preferences" = {
action-double-click-titlebar = "none";
@@ -15,6 +15,7 @@ _: {
'';
# Code Editor
+ programs.zed-editor.userSettings."title_bar"."button_layout" = lib.mkForce "";
programs.vscode.profiles.default.userSettings = {
"window.titleBarStyle" = "custom";
"window.controlsStyle" = "hidden";
diff --git a/modules/desktop/gnome/_main.nix b/modules/desktop/gnome/_main.nix
@@ -76,7 +76,7 @@
];
};
- home = _: {
+ home = {pkgs, ...}: {
config = {
# Default Applications
xdg.mimeApps.defaultApplications = util.build.mime {
@@ -147,7 +147,7 @@
# Browser
firefox = {
- enableGnomeExtensions = true;
+ nativeMessagingHosts = [pkgs.gnome-browser-connector];
policies.ExtensionSettings = {
name = "gnome-shell-integration";
value = {
diff --git a/modules/hosts/valkyrie/default.nix b/modules/hosts/valkyrie/default.nix
@@ -9,7 +9,6 @@
nixosModules = [
"boot"
- "security"
"prompt"
"mobile"
"printer"
@@ -39,6 +38,7 @@
mixedModules = [
"base-ext"
"filesystem"
+ "security"
"laptop"
"mouse"
"shell-utils"
diff --git a/modules/hosts/vortex.nix b/modules/hosts/vortex.nix
@@ -15,6 +15,7 @@
"laptop"
"discord"
"firefox"
+ "security"
"internet"
"office"
"wine"
diff --git a/modules/system/security.nix b/modules/system/security.nix
@@ -1,119 +0,0 @@
-## Security & Hardening Settings ##
-{config, ...}: let
- inherit (config.flake) files;
-in {
- flake.modules.nixos.security = {lib, ...}: {
- config = {
- security = {
- protectKernelImage = false;
-
- # Sudo
- sudo = {
- execWheelOnly = true;
- extraConfig = ''
- Defaults pwfeedback
- Defaults lecture = always, lecture_file = ${files.ascii.groot}
- '';
- };
-
- # Sandbox
- #! https://discourse.nixos.org/t/apparmor-on-nixos-roadmap/57217
- apparmor.enable = false;
- };
- programs.firejail.enable = true;
-
- # Recovery Account
- specialisation.recovery.configuration = {
- home-manager.verbose = true;
- services.openssh.enable = lib.mkForce false;
- security.sudo.extraConfig = lib.mkAfter "recovery ALL=(ALL:ALL) NOPASSWD:ALL";
- users.extraUsers.recovery = {
- name = "recovery";
- description = "Recovery Account";
- isNormalUser = true;
- uid = 1100;
- group = "users";
- extraGroups = ["wheel"];
- useDefaultShell = true;
- initialHashedPassword = lib.mkDefault (lib.fileContents ../../secrets/passwords/default);
- };
- };
-
- # Hardening
- networking.stevenblack.enable = true; # Block Junk Sites
- boot = {
- # Kernel
- kernelParams = [
- "page_alloc.shuffle=1"
- "page_poison=1"
- "slub_debug=FZP"
- ];
-
- # Network
- kernel.sysctl = {
- "kernel.ftrace_enabled" = false;
- "kernel.kexec_load_disabled" = true;
- "kernel.kptr_restrict" = lib.mkOverride 500 2;
- "kernel.sysrq" = 176;
- "kernel.yama.ptrace_scope" = lib.mkOverride 500 1;
-
- "net.core.bpf_jit_enable" = true;
- "net.core.default_qdisc" = "cake";
- "net.ipv4.conf.all.accept_redirects" = false;
- "net.ipv4.conf.all.accept_source_route" = 0;
- "net.ipv4.conf.all.log_martians" = true;
- "net.ipv4.conf.all.rp_filter" = 1;
- "net.ipv4.conf.all.secure_redirects" = false;
- "net.ipv4.conf.all.send_redirects" = false;
- "net.ipv4.conf.default.accept_redirects" = false;
- "net.ipv4.conf.default.log_martians" = true;
- "net.ipv4.conf.default.rp_filter" = 1;
- "net.ipv4.conf.default.secure_redirects" = false;
- "net.ipv4.conf.default.send_redirects" = false;
- "net.ipv4.icmp_echo_ignore_broadcasts" = true;
- "net.ipv4.icmp_ignore_bogus_error_responses" = 1;
- "net.ipv4.tcp_congestion_control" = "bbr";
- "net.ipv4.tcp_fastopen" = 3;
- "net.ipv4.tcp_rfc1337" = 1;
- "net.ipv4.tcp_syncookies" = 1;
- "net.ipv6.conf.all.accept_redirects" = false;
- "net.ipv6.conf.all.accept_source_route" = 0;
- "net.ipv6.conf.default.accept_redirects" = false;
- };
-
- # Secure Modules
- kernelModules = ["tcp_bbr"];
-
- # Old & Obscure Modules
- blacklistedKernelModules = [
- # Network Protocols
- "ax25"
- "netrom"
- "rose"
-
- # Filesystems
- "adfs"
- "affs"
- "befs"
- "bfs"
- "cramfs"
- "efs"
- "erofs"
- "exofs"
- "f2fs"
- "freevxfs"
- "hfs"
- "hpfs"
- "jfs"
- "minix"
- "nilfs2"
- "omfs"
- "qnx4"
- "qnx6"
- "sysv"
- "ufs"
- ];
- };
- };
- };
-}
diff --git a/modules/system/security/_browser.nix b/modules/system/security/_browser.nix
@@ -0,0 +1,99 @@
+# Browser Sandbox
+{
+ config,
+ inputs,
+ lib,
+ pkgs,
+ ...
+}: let
+ appId = "org.mozilla.firefox";
+ firefox = config.programs.firefox.finalPackage;
+ sandbox = (inputs.nixpak.lib.nixpak {inherit lib pkgs;}) {
+ config = {sloth, ...}: {
+ app = {
+ package = firefox;
+ binPath = "bin/firefox";
+ };
+ flatpak.appId = appId;
+
+ gpu = {
+ enable = true;
+ provider = "nixos";
+ };
+ locale.enable = true;
+ etc.sslCertificates.enable = true;
+ dbus = {
+ policies = {
+ "${appId}" = "own";
+ "${appId}.*" = "own";
+ "org.mpris.MediaPlayer2.${appId}.*" = "own";
+ "org.freedesktop.DBus" = "talk";
+ "ca.desrt.dconf" = "talk";
+ "org.freedesktop.portal.Desktop" = "talk";
+ "org.freedesktop.portal.Documents" = "talk";
+ "org.freedesktop.portal.FileChooser" = "talk";
+ "org.freedesktop.portal.Notification" = "talk";
+ "org.freedesktop.portal.OpenURI" = "talk";
+ "org.freedesktop.portal.ScreenCast" = "talk";
+ "org.freedesktop.portal.Camera" = "talk";
+ "org.freedesktop.portal.Request" = "talk";
+ "org.freedesktop.Notifications" = "talk";
+ "org.kde.StatusNotifierWatcher" = "talk";
+ "org.a11y.Bus" = "talk";
+ };
+ rules.broadcast."org.freedesktop.portal.*" = ["@/org/freedesktop/portal/*"];
+ args = ["--filter" "--sloppy-names"];
+ };
+
+ bubblewrap = {
+ network = true;
+ sockets = {
+ wayland = true;
+ pipewire = true;
+ pulse = true;
+ x11 = false;
+ };
+
+ bind.rw = [
+ (sloth.mkdir (sloth.concat' sloth.xdgConfigHome "/mozilla/firefox"))
+ (sloth.mkdir (sloth.concat' sloth.xdgCacheHome "/mozilla"))
+ sloth.xdgDownloadDir
+
+ (sloth.concat' sloth.runtimeDir "/at-spi/bus")
+ (sloth.concat' sloth.runtimeDir "/doc")
+ (sloth.concat' sloth.runtimeDir "/gvfsd")
+ (sloth.concat' sloth.xdgCacheHome "/fontconfig")
+
+ (sloth.concat' sloth.runtimeDir "/app/org.keepassxc.KeePassXC")
+ ];
+
+ bind.ro = [
+ "/sys/bus/pci"
+ ["${firefox}/lib/firefox" "/app/etc/firefox"]
+ (sloth.concat' sloth.homeDir "/.mozilla/native-messaging-hosts")
+
+ "/run/current-system"
+ "/etc/profiles/per-user/${config.home.username}"
+ "/etc/xdg"
+
+ (sloth.concat' sloth.xdgDataHome "/icons")
+ (sloth.concat' sloth.xdgConfigHome "/gtk-3.0")
+ (sloth.concat' sloth.xdgConfigHome "/gtk-4.0")
+ (sloth.concat' sloth.xdgConfigHome "/fontconfig")
+ (sloth.concat' sloth.xdgConfigHome "/dconf")
+ "/etc/fonts"
+ "/etc/localtime"
+ "/etc/zoneinfo"
+ ];
+
+ bind.dev = ["/dev/shm"];
+ tmpfs = ["/tmp"];
+ newSession = true;
+ };
+ };
+ };
+in {
+ config = lib.mkIf config.programs.firefox.enable {
+ home.packages = [(lib.hiPrio sandbox.config.env)];
+ };
+}
diff --git a/modules/system/security/default.nix b/modules/system/security/default.nix
@@ -0,0 +1,124 @@
+## Security & Hardening Settings ##
+{config, ...}: let
+ inherit (config.flake) files;
+in {
+ flake.modules = {
+ nixos.security = {lib, ...}: {
+ config = {
+ security = {
+ protectKernelImage = false;
+
+ # Sudo
+ sudo = {
+ execWheelOnly = true;
+ extraConfig = ''
+ Defaults pwfeedback
+ Defaults lecture = always, lecture_file = ${files.ascii.groot}
+ '';
+ };
+
+ # Sandbox
+ #! https://discourse.nixos.org/t/apparmor-on-nixos-roadmap/57217
+ apparmor.enable = false;
+ };
+ programs.firejail.enable = true;
+
+ # Recovery Account
+ specialisation.recovery.configuration = {
+ home-manager.verbose = true;
+ services.openssh.enable = lib.mkForce false;
+ security.sudo.extraConfig = lib.mkAfter "recovery ALL=(ALL:ALL) NOPASSWD:ALL";
+ users.extraUsers.recovery = {
+ name = "recovery";
+ description = "Recovery Account";
+ isNormalUser = true;
+ uid = 1100;
+ group = "users";
+ extraGroups = ["wheel"];
+ useDefaultShell = true;
+ initialHashedPassword = lib.mkDefault (lib.fileContents ../../../secrets/passwords/default);
+ };
+ };
+
+ # Hardening
+ networking.stevenblack.enable = true; # Block Junk Sites
+ boot = {
+ # Kernel
+ kernelParams = [
+ "page_alloc.shuffle=1"
+ "page_poison=1"
+ "slub_debug=FZP"
+ ];
+
+ # Network
+ kernel.sysctl = {
+ "kernel.ftrace_enabled" = false;
+ "kernel.kexec_load_disabled" = true;
+ "kernel.kptr_restrict" = lib.mkOverride 500 2;
+ "kernel.sysrq" = 176;
+ "kernel.yama.ptrace_scope" = lib.mkOverride 500 1;
+
+ "net.core.bpf_jit_enable" = true;
+ "net.core.default_qdisc" = "cake";
+ "net.ipv4.conf.all.accept_redirects" = false;
+ "net.ipv4.conf.all.accept_source_route" = 0;
+ "net.ipv4.conf.all.log_martians" = true;
+ "net.ipv4.conf.all.rp_filter" = 1;
+ "net.ipv4.conf.all.secure_redirects" = false;
+ "net.ipv4.conf.all.send_redirects" = false;
+ "net.ipv4.conf.default.accept_redirects" = false;
+ "net.ipv4.conf.default.log_martians" = true;
+ "net.ipv4.conf.default.rp_filter" = 1;
+ "net.ipv4.conf.default.secure_redirects" = false;
+ "net.ipv4.conf.default.send_redirects" = false;
+ "net.ipv4.icmp_echo_ignore_broadcasts" = true;
+ "net.ipv4.icmp_ignore_bogus_error_responses" = 1;
+ "net.ipv4.tcp_congestion_control" = "bbr";
+ "net.ipv4.tcp_fastopen" = 3;
+ "net.ipv4.tcp_rfc1337" = 1;
+ "net.ipv4.tcp_syncookies" = 1;
+ "net.ipv6.conf.all.accept_redirects" = false;
+ "net.ipv6.conf.all.accept_source_route" = 0;
+ "net.ipv6.conf.default.accept_redirects" = false;
+ };
+
+ # Secure Modules
+ kernelModules = ["tcp_bbr"];
+
+ # Old & Obscure Modules
+ blacklistedKernelModules = [
+ # Network Protocols
+ "ax25"
+ "netrom"
+ "rose"
+
+ # Filesystems
+ "adfs"
+ "affs"
+ "befs"
+ "bfs"
+ "cramfs"
+ "efs"
+ "erofs"
+ "exofs"
+ "f2fs"
+ "freevxfs"
+ "hfs"
+ "hpfs"
+ "jfs"
+ "minix"
+ "nilfs2"
+ "omfs"
+ "qnx4"
+ "qnx6"
+ "sysv"
+ "ufs"
+ ];
+ };
+ };
+ };
+
+ # Browser Sandbox
+ homeManager.security = _: {imports = [./_browser.nix];};
+ };
+}
diff --git a/modules/system/user/default.nix b/modules/system/user/default.nix
@@ -41,6 +41,7 @@ in {
useGlobalPkgs = true;
useUserPackages = true;
backupFileExtension = "bak";
+ extraSpecialArgs = {inherit inputs;};
# Default Modules
sharedModules =