commit 57db548d1994905e83ac0a5852fbe40152fe073a
parent b5789d2df88846e9f86f5481032c2d8f46bc3556
Author: maydayv7 <maydayv7@gmail.com>
Date: Sun, 28 Jun 2026 02:10:26 +0530
feat: Security + VirtioFS
- Disable keyless SSH Access
- Patch virtiofsd + kvmfr bug
Diffstat:
15 files changed, 189 insertions(+), 79 deletions(-)
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,7 @@
### June
+- Disable keyless SSH Access
- Declaratively configure a Windows 11 VM
- Fix and document VFIO
- Use KVMFR with Looking Glass
diff --git a/flake.lock b/flake.lock
@@ -1694,11 +1694,11 @@
]
},
"locked": {
- "lastModified": 1782228865,
- "narHash": "sha256-vnmo148gkbMNtyNoWYzcPOKCoaAq+zY69WE2xgMox/I=",
+ "lastModified": 1782579392,
+ "narHash": "sha256-OWXJUaqtsLSHYKyQk3E0AVH3J4XWBvkaT7XCORHcHUo=",
"owner": "noctalia-dev",
"repo": "noctalia",
- "rev": "efb96e41fdac7cb3e5bcc9864d1bd0118da2470f",
+ "rev": "ebf763a9bc18d8859c5e4f78f5f387137f0caa54",
"type": "github"
},
"original": {
diff --git a/modules/README.md b/modules/README.md
@@ -91,11 +91,11 @@ An overview of every configuration module in this repository.
| Module | Type | Description |
| ------------ | ----- | ----------------------------------- |
| `base` ★ | Both | Base system configuration |
+| `base-ext` | Both | Extended base configuration |
+| `boot` | NixOS | Boot loader configuration |
+| `filesystem` | Both | File system layout |
| `nix` ★ | Both | Nix daemon & settings |
| `user` ★ | Both | User accounts & Home Manager wiring |
-| `filesystem` | Both | File system layout |
-| `base-ext` | NixOS | Extended base configuration |
-| `boot` | NixOS | Boot loader configuration |
| `security` | NixOS | Security & hardening |
### [`virt`](./virt)
diff --git a/modules/desktop/_wm/shell.nix b/modules/desktop/_wm/shell.nix
@@ -29,11 +29,19 @@
launch_apps_as_systemd_services = true;
settings_show_advanced = true;
panel.launcher_session_search = true;
+ shadow.direction = "center";
screen_corners = {
enabled = true;
size = 30;
};
- shadow.direction = "center";
+
+ # Screenshots
+ screenshot = {
+ save_to_file = true;
+ copy_to_clipboard = true;
+ freeze_screen = true;
+ directory = "~/Pictures/Screenshots";
+ };
};
theme = {
@@ -139,14 +147,6 @@
};
};
- # Screenshots
- shell.screenshot = {
- save_to_file = true;
- copy_to_clipboard = true;
- freeze_screen = true;
- directory = "~/Pictures/Screenshots";
- };
-
# Wallpaper
wallpaper = {
enabled = true;
diff --git a/modules/desktop/niri/_features/shell.nix b/modules/desktop/niri/_features/shell.nix
@@ -0,0 +1,6 @@
+## Shell Integration
+_: {
+ home = _: {
+ programs.noctalia.settings.shell.niri_overview_type_to_launch_enabled = true;
+ };
+}
diff --git a/modules/desktop/niri/_settings/keybinds.nix b/modules/desktop/niri/_settings/keybinds.nix
@@ -66,10 +66,18 @@ in {
# Mouse
"Super+Shift+MouseRight".action = switch-preset-window-width;
"Super+WheelScrollUp" = {
- action = focus-workspace-up;
+ action = focus-column-left;
cooldown-ms = 150;
};
"Super+WheelScrollDown" = {
+ action = focus-column-right;
+ cooldown-ms = 150;
+ };
+ "Super+Shift+WheelScrollUp" = {
+ action = focus-workspace-up;
+ cooldown-ms = 150;
+ };
+ "Super+Shift+WheelScrollDown" = {
action = focus-workspace-down;
cooldown-ms = 150;
};
diff --git a/modules/hosts/futura.nix b/modules/hosts/futura.nix
@@ -18,7 +18,11 @@
in {
configurations.nixos.futura = {
system = "x86_64-linux";
- module = {pkgs, ...}: {
+ module = {
+ config,
+ pkgs,
+ ...
+ }: {
imports =
util.map.array [
"boot"
@@ -67,11 +71,11 @@ in {
uid = 1000;
group = "users";
shell = pkgs.zsh;
+ hashedPasswordFile = config.sops.secrets."navya.secret".path;
extraGroups = [
"wheel"
"networkmanager"
];
- initialHashedPassword = "";
};
home-manager.users.navya.imports =
diff --git a/modules/hosts/valkyrie/_vm/windows.xml b/modules/hosts/valkyrie/_vm/windows.xml
@@ -12,6 +12,7 @@
<hugepages>
<page size='1048576' unit='KiB'/>
</hugepages>
+ <access mode='shared'/>
</memoryBacking>
<vcpu placement='static'>6</vcpu>
<iothreads>1</iothreads>
@@ -79,6 +80,11 @@
<target dev='vda' bus='virtio'/>
<address type='pci' domain='0x0000' bus='0x04' slot='0x00' function='0x0'/>
</disk>
+ <filesystem type='mount' accessmode='passthrough'>
+ <driver type='virtiofs' queue='1024'/>
+ <source dir='/data/files'/>
+ <target dir='Files'/>
+ </filesystem>
<!-- Disk images
<disk type='file' device='cdrom'>
<driver name='qemu' type='raw'/>
@@ -230,6 +236,12 @@
</source>
<address type='pci' domain='0x0000' bus='0x07' slot='0x00' function='0x0'/>
</hostdev>
+ <hostdev mode='subsystem' type='usb' managed='yes'>
+ <source> <!-- Webcam -->
+ <vendor id='0x3277'/>
+ <product id='0x0018'/>
+ </source>
+ </hostdev>
<redirdev bus='usb' type='spicevmc'>
<address type='usb' bus='0' port='2'/>
</redirdev>
diff --git a/modules/hosts/valkyrie/default.nix b/modules/hosts/valkyrie/default.nix
@@ -8,7 +8,6 @@
inherit (config) util;
nixosModules = [
- "base-ext"
"boot"
"security"
"prompt"
@@ -37,6 +36,7 @@
];
mixedModules = [
+ "base-ext"
"filesystem"
"laptop"
"mouse"
diff --git a/modules/system/base-ext.nix b/modules/system/base-ext.nix
@@ -1,7 +1,11 @@
## Extended Base Configuration ##
_: {
flake.modules = {
- nixos.base-ext = {config, ...}: {
+ nixos.base-ext = {
+ config,
+ lib,
+ ...
+ }: {
# AppImage Support
programs.appimage = {
enable = true;
@@ -23,6 +27,61 @@ _: {
font-size=14
'';
};
+
+ # GPG & SSH
+ programs.gnupg.agent = {
+ enable = true;
+ enableSSHSupport = true;
+ };
+
+ environment.persist.directories = ["/etc/ssh"];
+ services.openssh = {
+ enable = true;
+ settings = {
+ PasswordAuthentication = false;
+ PermitEmptyPasswords = false;
+ KbdInteractiveAuthentication = false;
+ PermitRootLogin = lib.mkForce "no";
+ };
+
+ hostKeys = [
+ {
+ comment = "Host SSH Key";
+ bits = 4096;
+ type = "ed25519";
+ path = "/etc/ssh/ssh_key";
+ }
+ ];
+ };
+ };
+
+ homeManager.base-ext = _: {
+ home.persist.directories = [
+ {
+ directory = ".gnupg";
+ mode = "0700";
+ }
+ {
+ directory = ".ssh";
+ mode = "0700";
+ }
+ ];
+
+ programs.ssh = {
+ enable = true;
+ settings."*" = {
+ ForwardAgent = false;
+ AddKeysToAgent = "no";
+ Compression = false;
+ ServerAliveInterval = 0;
+ ServerAliveCountMax = 3;
+ HashKnownHosts = false;
+ UserKnownHostsFile = "~/.ssh/known_hosts";
+ ControlMaster = "no";
+ ControlPath = "~/.ssh/master-%r@%n:%p";
+ ControlPersist = "no";
+ };
+ };
};
};
}
diff --git a/modules/system/base.nix b/modules/system/base.nix
@@ -128,32 +128,8 @@ _: {
freeSwapThreshold = 15;
};
- # GPG & SSH
- programs.gnupg.agent = {
- enable = true;
- enableSSHSupport = true;
- };
-
- services.openssh = {
- enable = true;
- settings = {
- PasswordAuthentication = true;
- PermitRootLogin = lib.mkForce "no";
- };
-
- hostKeys = [
- {
- comment = "Host SSH Key";
- bits = 4096;
- type = "ed25519";
- path = "/etc/ssh/ssh_key";
- }
- ];
- };
-
environment.persist.directories = [
"/etc/NetworkManager"
- "/etc/ssh"
"/var/lib/alsa"
"/var/lib/bluetooth"
];
@@ -161,35 +137,7 @@ _: {
};
homeManager.base = {lib, ...}: {
- home = {
- stateVersion = lib.mkDefault lib.trivial.release;
- persist.directories = [
- {
- directory = ".gnupg";
- mode = "0700";
- }
- {
- directory = ".ssh";
- mode = "0700";
- }
- ];
- };
-
- programs.ssh = {
- enable = true;
- settings."*" = {
- ForwardAgent = false;
- AddKeysToAgent = "no";
- Compression = false;
- ServerAliveInterval = 0;
- ServerAliveCountMax = 3;
- HashKnownHosts = false;
- UserKnownHostsFile = "~/.ssh/known_hosts";
- ControlMaster = "no";
- ControlPath = "~/.ssh/master-%r@%n:%p";
- ControlPersist = "no";
- };
- };
+ home.stateVersion = lib.mkDefault lib.trivial.release;
};
};
}
diff --git a/modules/system/security.nix b/modules/system/security.nix
@@ -31,6 +31,7 @@ in {
# Recovery Account
specialisation.recovery.configuration = {
home-manager.verbose = true;
+ services.openssh.enable = lib.mkForce false;
security.sudo.extraConfig = lib.mkAfter "recovery ALL=(ALL:ALL) NOPASSWD:ALL";
users.extraUsers.recovery = {
name = "recovery";
diff --git a/packages/overlays/virtiofsd.nix b/packages/overlays/virtiofsd.nix
@@ -0,0 +1,18 @@
+final: prev: {
+ # virtiofs + kvmfr bug patch
+ virtiofsd = let
+ src = final.fetchFromGitLab {
+ owner = "virtio-fs";
+ repo = "virtiofsd";
+ rev = "2424fed9673f4a013e44b6f59a95427c71757c84";
+ hash = "sha256-2mrydMqjduG0yGDekZbE0VGIun+3/UVe0OxBOgyCLK8=";
+ };
+ in
+ prev.virtiofsd.overrideAttrs (_: {
+ inherit src;
+ cargoDeps = final.rustPlatform.fetchCargoVendor {
+ inherit src;
+ hash = "sha256-MOEozjN8EbHNyMSSSOP2/GFhlsY5RYOKWOkuGfHewP4=";
+ };
+ });
+}
diff --git a/secrets/passwords/default b/secrets/passwords/default
@@ -1 +1 @@
-$6$oDyuxGchrVIc19OC$eXjScbMdvd3Z77huNEUzTmXHvtDrjXK6/VnFNIxfiGUZAtJ1tLF05H6bp6J6CaV4.BkkiN72CIWLfvgg0AwdF.
-\ No newline at end of file
+$6$FNx60H2FPuC1zrR4$2UgQu2jzG5QpPpyxSk7KDrA51AinbcdUfn/iorYsAu.8AFQqpP2NPmWAU9kKAAMA.aEfZAP8y1DQKb3rvZjwR/
+\ No newline at end of file
diff --git a/site/content/blog/nixos/win11vm.md b/site/content/blog/nixos/win11vm.md
@@ -182,9 +182,6 @@ Inside Windows, install the following:
Then run `looking-glass-client` on the host, and a full-resolution Windows desktop appears in a window, GPU-accelerated, captured off the GPU framebuffer over DirectX 12. Keyboard, mouse and clipboard ride back over SPICE.
-> [!NOTE]
-> Enabling **autologon** in Windows lets the host app (and the virtual display) come up automatically at boot - otherwise the desktop only exists after you log in.
-
# Performance tuning
The values below (which cores, how many hugepages) are **machine-specific** - compute them from your own topology.
@@ -249,7 +246,7 @@ Request them in the domain, and drop the memory balloon (it fights fixed hugepag
<memballoon model='none'/>
```
-> [!IMPORTANT]
+> [!NOTE]
> Keep these in sync: the `<cputune>` cpuset must match `isolcpus`, and the hugepage count must match the guest's RAM.
## Other tweaks
@@ -300,6 +297,62 @@ The virtio NIC on libvirt's default network gives the guest internet through NAT
$ virsh -c qemu:///system net-autostart default
```
+# File sharing
+
+[virtiofs](https://virtio-fs.gitlab.io/) shares a host directory straight into the guest over a shared-memory transport - much faster than SMB.
+Point a `<filesystem>` device at the host path and give it a tag:
+
+```xml
+<filesystem type='mount' accessmode='passthrough'>
+ <driver type='virtiofs' queue='1024'/>
+ <source dir='/data/files'/>
+ <target dir='Files'/>
+</filesystem>
+```
+
+The device needs access to guest RAM, so the memory backing must be **shared**:
+
+```xml
+<memoryBacking>
+ <hugepages><page size='1048576' unit='KiB'/></hugepages>
+ <access mode='shared'/>
+</memoryBacking>
+```
+
+Host-side, libvirt spawns the `virtiofsd` daemon - just hand it the package:
+
+```nix
+virtualisation.libvirtd.qemu.vhostUserPackages = [ pkgs.virtiofsd ];
+```
+
+Inside Windows, the `virtio-win-guest-tools` installer ships the **VirtIO-FS** driver and the `VirtioFsSvc` service. You must additionally install [WinFSP](https://winfsp.dev/) - the user-mode filesystem layer it depends on, then start the service so it mounts (set it to Automatic so it survives reboots):
+
+```console
+> sc start VirtioFsSvc
+```
+
+# USB passthrough
+
+For an **ad-hoc** device, `virt-manager` is the easiest route: open the running guest, _Add Hardware → USB Host Device_, pick it from the list, and it's hot-plugged into Windows. SPICE USB redirection is also enabled, so the _Redirect USB Device_ menu option can be used as well.
+
+For something you want **always** attached - say a webcam - bind it by USB ID in the domain instead. Find it with `lsusb`:
+
+```console
+$ lsusb
+Bus 003 Device 002: ID 3277:0018 Sonix Technology Co., Ltd. USB2.0 FHD UVC WebCam
+```
+
+Then add a USB `<hostdev>`:
+
+```xml
+<hostdev mode='subsystem' type='usb' managed='yes'>
+ <source>
+ <vendor id='0x3277'/>
+ <product id='0x0018'/>
+ </source>
+</hostdev>
+```
+
# Useful commands
Run as your user (in the `libvirtd` + `kvm` groups, no `sudo` needed):