dotfiles

My PC Dotfiles & Website
git clone https://github.com/maydayv7/dotfiles

default.nix (3184B)

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
## Security & Hardening Settings ##
{config, ...}: let
  inherit (config.flake) files;
in {
  flake.modules = {
    nixos.security = {lib, ...}: {
      config = {
        security = {
          protectKernelImage = false;

          # Sudo
          sudo = {
            execWheelOnly = true;
            extraConfig = ''
              Defaults pwfeedback
              Defaults lecture = always, lecture_file = ${files.ascii.groot}
            '';
          };

          # Sandbox
          # ! # https://discourse.nixos.org/t/apparmor-on-nixos-roadmap/57217
          apparmor.enable = false;
        };
        programs.firejail.enable = true;

        ## Hardening
        networking.stevenblack.enable = true; # Block Junk Sites
        boot = {
          # Kernel
          kernelParams = [
            "page_alloc.shuffle=1"
            "page_poison=1"
            "slub_debug=FZP"
          ];

          # Network
          kernel.sysctl = {
            "kernel.ftrace_enabled" = false;
            "kernel.kexec_load_disabled" = true;
            "kernel.kptr_restrict" = lib.mkOverride 500 2;
            "kernel.sysrq" = 176;
            "kernel.yama.ptrace_scope" = lib.mkOverride 500 1;

            "net.core.bpf_jit_enable" = true;
            "net.core.default_qdisc" = "cake";
            "net.ipv4.conf.all.accept_redirects" = false;
            "net.ipv4.conf.all.accept_source_route" = 0;
            "net.ipv4.conf.all.log_martians" = true;
            "net.ipv4.conf.all.rp_filter" = 1;
            "net.ipv4.conf.all.secure_redirects" = false;
            "net.ipv4.conf.all.send_redirects" = false;
            "net.ipv4.conf.default.accept_redirects" = false;
            "net.ipv4.conf.default.log_martians" = true;
            "net.ipv4.conf.default.rp_filter" = 1;
            "net.ipv4.conf.default.secure_redirects" = false;
            "net.ipv4.conf.default.send_redirects" = false;
            "net.ipv4.icmp_echo_ignore_broadcasts" = true;
            "net.ipv4.icmp_ignore_bogus_error_responses" = 1;
            "net.ipv4.tcp_congestion_control" = "bbr";
            "net.ipv4.tcp_fastopen" = 3;
            "net.ipv4.tcp_rfc1337" = 1;
            "net.ipv4.tcp_syncookies" = 1;
            "net.ipv6.conf.all.accept_redirects" = false;
            "net.ipv6.conf.all.accept_source_route" = 0;
            "net.ipv6.conf.default.accept_redirects" = false;
          };

          # Secure Modules
          kernelModules = ["tcp_bbr"];

          # Old & Obscure Modules
          blacklistedKernelModules = [
            # Network Protocols
            "ax25"
            "netrom"
            "rose"

            # Filesystems
            "adfs"
            "affs"
            "befs"
            "bfs"
            "cramfs"
            "efs"
            "erofs"
            "exofs"
            "f2fs"
            "freevxfs"
            "hfs"
            "hpfs"
            "jfs"
            "minix"
            "nilfs2"
            "omfs"
            "qnx4"
            "qnx6"
            "sysv"
            "ufs"
          ];
        };
      };
    };

    # Browser Sandbox
    homeManager.security = _: {imports = [./_browser.nix];};
  };
}