diff options
| -rw-r--r-- | flake.lock | 6 | ||||
| -rw-r--r-- | modules/common.nix | 123 |
2 files changed, 96 insertions, 33 deletions
diff --git a/flake.lock b/flake.lock index d969900..1d68f77 100644 --- a/flake.lock +++ b/flake.lock @@ -124,11 +124,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1776734388, - "narHash": "sha256-vl3dkhlE5gzsItuHoEMVe+DlonsK+0836LIRDnm6MXQ=", + "lastModified": 1778737229, + "narHash": "sha256-6xWoytx8jFW4PF1GjRm/i/53trbpKGfz6zjzQGBr4cI=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "10e7ad5bbcb421fe07e3a4ad53a634b0cd57ffac", + "rev": "d7a713c0b7e47c908258e71cba7a2d77cc8d71d5", "type": "github" }, "original": { diff --git a/modules/common.nix b/modules/common.nix index 5766037..153b290 100644 --- a/modules/common.nix +++ b/modules/common.nix @@ -1,4 +1,11 @@ -{ me, util, config, lib, pkgs, ... }: +{ + me, + util, + config, + lib, + pkgs, + ... +}: { imports = [ @@ -12,17 +19,15 @@ ./vim.nix ]; - boot.kernelPackages = pkgs.linuxPackages_latest; - # fish enables this by default, # it makes every nixos rebuild very slow. documentation.man.generateCaches = false; users.motd = '' -/^ /^ -\ ' ' 7 < Hi, I'm ${util.titleCase me.name} -/ \ + /^ /^ + \ ' ' 7 < Hi, I'm ${util.titleCase me.name} + / \ ''; @@ -30,7 +35,10 @@ hostName = me.name; useDHCP = false; dhcpcd.enable = false; - nameservers = [ "1.1.1.1" "1.0.0.1" ]; + nameservers = [ + "1.1.1.1" + "1.0.0.1" + ]; nftables = { enable = true; @@ -39,7 +47,10 @@ firewall = { enable = true; - allowedTCPPorts = [ 80 443 ]; + allowedTCPPorts = [ + 80 + 443 + ]; }; }; @@ -48,11 +59,27 @@ wait-online.anyInterface = true; }; - boot.kernel.sysctl = { - # turn all of the ip forwarding on - "net.ipv4.ip_forward" = lib.mkDefault 1; - "net.ipv6.conf.all.forwarding" = lib.mkDefault 1; - "net.ipv6.conf.default.forwarding" = lib.mkDefault 1; + boot = { + kernelPackages = pkgs.linuxPackages_latest; + + kernel.sysctl = { + # turn all of the ip forwarding on + "net.ipv4.ip_forward" = lib.mkDefault 1; + "net.ipv6.conf.all.forwarding" = lib.mkDefault 1; + "net.ipv6.conf.default.forwarding" = lib.mkDefault 1; + }; + + # mitigations + blacklistedKernelModules = [ + # copy fail (cve-2026-31431) + "algif_aead" + + # dirty frag (cve-2026-43284) + "esp4" # ipv4 ipsec esp variant + "esp6" # ipv6 ipsec esp variant + "rxrpc" # rxrpc variant + # note: these mitigations kill ipsec, though we never use it. + ]; }; services.envfs.enable = true; @@ -92,7 +119,12 @@ openssh = { enable = true; openFirewall = false; - listenAddresses = [{ addr = me.tailscale.ip; port = 22; }]; + listenAddresses = [ + { + addr = me.tailscale.ip; + port = 22; + } + ]; settings = { PasswordAuthentication = false; KbdInteractiveAuthentication = false; @@ -120,20 +152,51 @@ }; }; - environment.systemPackages = (with pkgs; [ - file unzip jq dig htop glances wget - gnupg pinentry-curses age agenix - inetutils pciutils lshw inxi iw dmidecode - tcpdump - nftables wireguard-tools - ffmpeg_7-headless - - ripgrep gnumake gdb gcc clang dtc - go gopls delve go-task - meson cmake - nil direnv nixfmt-rfc-style - dive compose2nix nix-prefetch-docker - - borgbackup - ]); + environment.systemPackages = ( + with pkgs; + [ + file + unzip + jq + dig + htop + glances + wget + gnupg + pinentry-curses + age + agenix + inetutils + pciutils + lshw + inxi + iw + dmidecode + tcpdump + nftables + wireguard-tools + ffmpeg_7-headless + + ripgrep + gnumake + gdb + gcc + clang + dtc + go + gopls + delve + go-task + meson + cmake + nil + direnv + nixfmt-rfc-style + dive + compose2nix + nix-prefetch-docker + + borgbackup + ] + ); } |